{"id":95716,"date":"2020-10-02T01:42:50","date_gmt":"2020-10-01T23:42:50","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/inicziativa-dns-flag-day-2020-dlya-resheniya-problem-s-fragmentacziej-i-podderzhkoj-tcp"},"modified":"2020-10-02T01:42:50","modified_gmt":"2020-10-01T23:42:50","slug":"inicziativa-dns-flag-day-2020-dlya-resheniya-problem-s-fragmentacziej-i-podderzhkoj-tcp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/inicziativa-dns-flag-day-2020-dlya-resheniya-problem-s-fragmentacziej-i-podderzhkoj-tcp","title":{"rendered":"Ini\u021biativa DNS flag day 2020 pentru a aborda problemele de fragmentare \u0219i suportul TCP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ast\u0103zi, o serie de mari servicii DNS \u0219i produc\u0103tori de servere DNS vor organiza un eveniment comun DNS flag day 2020<\/a><\/noindex>, destinat s\u0103 concentreze aten\u021bia asupra solu\u021bion\u0103rii<\/a><\/noindex> problemelor<\/a><\/noindex> cu fragmentarea IP \u00een procesarea mesajelor DNS de mari dimensiuni. Aceasta este a doua astfel de activitate, anul trecut a fost «ziua steagului DNS» s-a concentrat<\/a><\/noindex> pe procesarea corect\u0103 a cererilor EDNS. <\/p>\n

Participan\u021bii la ini\u021biativa ziua steagului DNS 2020 \u00eendeamn\u0103 la stabilirea dimensiunilor recomandate ale bufferelor pentru EDNS la valori de 1232 de octe\u021bi (dimensiunea MTU 1280 minus 48 de octe\u021bi pentru antete), precum \u0219i a traduce<\/a><\/noindex> procesarea cererilor prin TCP ca fiind o necesitate obligatorie pe servere. \u00cen RFC 1035<\/a><\/noindex> se men\u021bioneaz\u0103 obligatorie doar suportul pentru procesarea cererilor prin UDP, iar TCP este men\u021bionat ca fiind dorit, dar nu obligatoriu pentru func\u021bionare. Noile RFC 7766<\/a><\/noindex> \u0219i RFC 5966<\/a><\/noindex> se refer\u0103 explicit la TCP ca fiind o capacitate esen\u021bial\u0103 necesar\u0103 pentru func\u021bionarea corect\u0103 a DNS. \u00cen cadrul ini\u021biativei \u00een desf\u0103\u0219urare, se propune \u00eencurajarea tranzi\u021biei de la trimiterea cererilor prin UDP la utilizarea TCP \u00een cazurile c\u00e2nd dimensiunea bufferului EDNS nu este suficient\u0103.<\/p>\n

Modific\u0103rile propuse vor elimina confuzia legat\u0103 de alegerea dimensiunii bufferului EDNS \u0219i vor rezolva problema fragment\u0103rii mesajelor UDP mari, a c\u0103ror procesare duce adesea la pierderi de pachete \u0219i timeout-uri pe partea clientului. Pe partea clientului, dimensiunea bufferului EDNS va fi constant\u0103, iar r\u0103spunsurile mari vor fi trimise imediat clientului prin TCP. Excluderea trimiterii mesajelor mari prin UDP va rezolva, de asemenea, problemele de respingere a pachetelor mari pe unele firewall-uri \u0219i va permite blocarea atacuri<\/a><\/noindex> atacurilor de \u00eembun\u0103t\u0103\u021bire a cache-ului DNS, bazate pe manipularea pachetelor UDP fragmentate (la fragmentare, al doilea fragment nu con\u021bine antetul cu identificatorul, astfel poate fi falsificat, av\u00e2nd doar nevoie s\u0103 se potriveasc\u0103 cu suma de control).<\/p>\n

\u00cencep\u00e2nd de ast\u0103zi, furnizorii de DNS implica\u021bi \u00een ini\u021biativ\u0103, inclusiv CloudFlare, Quad 9, Cisco (OpenDNS) \u0219i Google, vor schimba treptat<\/a><\/noindex> dimensiunea bufferului EDNS de la 4096 la 1232 de octe\u021bi pe serverele lor DNS (schimbarea EDNS va fi extins\u0103 pe o perioad\u0103 de 4-6 s\u0103pt\u0103m\u00e2ni \u0219i \u00een timp va acoperi un num\u0103r tot mai mare de cereri). R\u0103spunsurile la cererile UDP care dep\u0103\u0219esc noua limit\u0103 vor fi trimise prin TCP. Produc\u0103torii de servere DNS, inclusiv BIND, Unbound, Knot, NSD \u0219i PowerDNS, vor lansa actualiz\u0103ri cu modificarea dimensiunii bufferului EDNS pentru setarea implicit\u0103 de la 4096 la 1232 de octe\u021bi. <\/p>\n

\u00cen cele din urm\u0103, modific\u0103rile introduse pot duce la probleme de rezolvare c\u00e2nd se face apel la serverele DNS, ale c\u0103ror r\u0103spunsuri DNS prin UDP dep\u0103\u0219esc 1232 de octe\u021bi \u0219i care nu pot trimite un r\u0103spuns prin TCP. Un experiment realizat de Google a ar\u0103tat c\u0103 modificarea dimensiunii buffer-ului EDNS nu va afecta semnificativ nivelul e\u0219ecurilor \u2014 cu un buffer de 4096 de octe\u021bi, num\u0103rul de solicit\u0103ri UDP t\u0103iate este de 0.345%, iar num\u0103rul de r\u0103spunsuri repetate nedisponibile prin TCP este de 0.115%. Cu un buffer de 1232 de octe\u021bi, aceste valori sunt de 0.367% \u0219i 0.116%. Transformarea suportului TCP \u00een cerin\u021be obligatorii pentru DNS va duce la probleme de interac\u021biune cu aproximativ 0.1% din serverele DNS. Se observ\u0103 c\u0103, \u00een condi\u021biile actuale, f\u0103r\u0103 TCP, func\u021bionarea acestor servere este deja instabil\u0103.<\/p>\n

Administratorii serverelor DNS autoritative ar trebui s\u0103 se asigure c\u0103 serverul lor r\u0103spunde prin TCP pe portul de re\u021bea 53 \u0219i c\u0103 acest port TCP nu este blocat de un firewall. Serverul DNS autoritativ nu ar trebui s\u0103 trimit\u0103 r\u0103spunsuri UDP, al c\u0103ror dimensiune dep\u0103\u0219e\u0219te
\ndimensiunea solicitat\u0103 a buffer-ului EDNS. Pe server, dimensiunea buffer-ului EDNS trebuie setat\u0103 la 1232 de octe\u021bi. Resolverele au cerin\u021be aproximativ similare \u2014 capacitatea obligatorie de a r\u0103spunde prin TCP, suport obligatoriu pentru retransmisia cererilor prin TCP \u00een cazul primirii unui r\u0103spuns t\u0103iat prin UDP \u0219i setarea buffer-ului EDNS la 1232 de octe\u021bi.<\/p>\n

Configurarea dimensiunii buffer-ului EDNS pe diferite servere DNS este responsabil\u0103 de urm\u0103torii parametri:<\/p>\n

  • BIND\n

    options {
    \n edns-udp-size 1232;
    \n max-udp-size 1232;
    \n };<\/p>\n

  • Knot DNS\n

    max-udp-payload: 1232<\/p>\n

  • Knot Resolver\n

    net.bufsize(1232)<\/p>\n

  • PowerDNS Authoritative\n

    udp-truncation-threshold=1232<\/p>\n

  • PowerDNS Recursor\n

    edns-outgoing-bufsize=1232
    \n udp-truncation-threshold=1232<\/p>\n

  • Unbound\n

    edns-buffer-size: 1232<\/p>\n

  • NSD\n

    ipv4-edns-size: 1232
    \n ipv6-edns-size: 1232<\/p>\n

    <\/a><\/noindex><\/p>\n

    Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u0440\u044f\u0434 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 DNS-\u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043f\u0440\u043e\u0432\u0435\u0434\u0443\u0442 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0435 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0435 DNS flag day 2020, \u043f\u0440\u0438\u0437\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u0444\u043e\u043a\u0443\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0440\u0435\u0448\u0435\u043d\u0438\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 IP-\u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 DNS-\u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u0431\u043e\u043b\u044c\u0448\u043e\u0433\u043e \u0440\u0430\u0437\u043c\u0435\u0440\u0430. \u042d\u0442\u043e \u0432\u0442\u043e\u0440\u043e\u0435 \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0435 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0435, \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 «DNS flag day» \u0431\u044b\u043b \u0441\u043e\u0441\u0440\u0435\u0434\u043e\u0442\u043e\u0447\u0435\u043d \u043d\u0430 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 EDNS. \u0423\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u0438 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u044b DNS flag day 2020 \u043f\u0440\u0438\u0437\u044b\u0432\u0430\u044e\u0442 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0440\u0430\u0437\u043c\u0435\u0440\u044b \u0431\u0443\u0444\u0435\u0440\u043e\u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-95716","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ini\u021biativa DNS flag day 2020 pentru a aborda problemele de fragmentare \u0219i suportul TCP | ProHoster","description":"Ast\u0103zi, o serie de mari servicii DNS \u0219i produc\u0103tori de servere DNS vor desf\u0103\u0219ura un eveniment comun DNS flag day 2020, destinat s\u0103 se concentreze.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/inicziativa-dns-flag-day-2020-dlya-resheniya-problem-s-fragmentacziej-i-podderzhkoj-tcp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u0430 DNS flag day 2020 \u0434\u043b\u044f \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u043e\u0439 TCP | ProHoster","og:description":"\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u0440\u044f\u0434 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 DNS-\u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043f\u0440\u043e\u0432\u0435\u0434\u0443\u0442 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0435 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0435 DNS flag day 2020, \u043f\u0440\u0438\u0437\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u0444\u043e\u043a\u0443\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/inicziativa-dns-flag-day-2020-dlya-resheniya-problem-s-fragmentacziej-i-podderzhkoj-tcp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-01T23:42:50+00:00","article:modified_time":"2020-10-01T23:42:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"95716","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:59:41","updated":"2022-10-02 16:18:32","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/95716","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=95716"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/95716\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=95716"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=95716"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=95716"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}