{"id":36194,"date":"2019-10-31T22:10:13","date_gmt":"2019-10-31T19:10:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/reliz-powerdns-recursor-4-2-i-initsiativa-dns-flag-day-2020\/"},"modified":"2019-10-31T22:10:13","modified_gmt":"2019-10-31T19:10:13","slug":"reliz-powerdns-recursor-4-2-i-initsiativa-dns-flag-day-2020","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/reliz-powerdns-recursor-4-2-i-initsiativa-dns-flag-day-2020","title":{"rendered":"L\u00ebshimi i PowerDNS Recursor 4.2 dhe iniciativa DNS flag day 2020","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pas pas nj\u00eb viti e gjysm\u00eb zhvillimi u paraqit<\/a><\/noindex> l\u00ebshimi i serverit DNS q\u00eb ruan kesh PowerDNS Recursor 4.2<\/a><\/noindex>, p\u00ebrgjegj\u00ebs p\u00ebr transformimin rekurziv t\u00eb emrave. PowerDNS Recursor \u00ebsht\u00eb nd\u00ebrtuar mbi t\u00eb nj\u00ebjtin kod me PowerDNS Authoritative Server, por server\u00ebt DNS rekurziv\u00eb dhe autoritativ\u00eb t\u00eb PowerDNS p\u00ebrparojn\u00eb n\u00eb cikle zhvillimi t\u00eb ndryshme dhe l\u00ebshohen si produkte t\u00eb ve\u00e7anta. Kodi i projektit shp\u00ebrndahet<\/a><\/noindex> n\u00eb p\u00ebrputhje me licenc\u00ebn GPLv2. <\/p>\n

N\u00eb versionin e ri jan\u00eb fshir\u00eb t\u00eb gjitha v\u00ebrejtjet lidhur me p\u00ebrpunimin e paketimeve DNS me flamujt EDNS. N\u00eb versionet e vjetra t\u00eb PowerDNS Recursor deri n\u00eb vitin 2016, praktikohej injorimi i paketimeve me flamuj EDNS q\u00eb nuk mb\u00ebshteten, pa d\u00ebrguar nj\u00eb p\u00ebrgjigje n\u00eb formatin e vjet\u00ebr, duke hedhur posht\u00eb flamujt EDNS, si\u00e7 k\u00ebrkon specifikimi. M\u00eb par\u00eb, nj\u00eb sjellje e till\u00eb jo standard mb\u00ebshtetej n\u00eb BIND si nj\u00eb manov\u00ebr p\u00ebr t\u00eb anashkaluar, por brenda iniciativ\u00ebs s\u00eb kryer<\/a><\/noindex> n\u00eb shkurt DNS flag day<\/a><\/noindex>, zhvilluesit e server\u00ebve DNS mor\u00ebn vendim p\u00ebr t\u00eb hequr dor\u00eb nga kjo hile. <\/p>\n

N\u00eb PowerDNS, problemet kryesore n\u00eb p\u00ebrpunimin e paketimeve me EDNS u eliminuan q\u00eb n\u00eb vitin 2017 me l\u00ebshimin 4.1, nd\u00ebrsa n\u00eb deg\u00ebn 4.0 t\u00eb l\u00ebshuar n\u00eb vitin 2016 shfaqeshin disa inkompatibilitete t\u00eb ve\u00e7anta q\u00eb ndodhnin n\u00eb rrethana t\u00eb caktuara dhe n\u00eb p\u00ebrgjith\u00ebsi nuk pengonin funksionimin normal. N\u00eb PowerDNS Recursor 4.2, ashtu si n\u00eb BIND 9.14<\/a><\/noindex>, jan\u00eb hequr t\u00eb gjitha manovrat p\u00ebr mb\u00ebshtetje t\u00eb server\u00ebve autoritativ\u00eb q\u00eb p\u00ebrgjigjen n\u00eb m\u00ebnyr\u00eb t\u00eb pap\u00ebrshtatshme ndaj k\u00ebrkesave me flamuj EDNS. P\u00ebr momentin, n\u00ebse pas d\u00ebrgimit t\u00eb nj\u00eb k\u00ebrkese me flamuj EDNS, pas nj\u00eb periudhe t\u00eb caktuar nuk merret nj\u00eb p\u00ebrgjigje, serveri DNS konsideronte se flamujt e zgjeruar nuk mb\u00ebshteten dhe d\u00ebrgonte nj\u00eb k\u00ebrkes\u00eb t\u00eb p\u00ebrs\u00ebritur pa flamuj EDNS. Q\u00eb tani e tutje, kjo sjellje \u00ebsht\u00eb \u00e7aktivizuar, pasi pranimi i k\u00ebtij kodi ka sjell\u00eb rritje t\u00eb vonesave p\u00ebr shkak t\u00eb d\u00ebrgimit t\u00eb p\u00ebrs\u00ebritur t\u00eb paketimeve, rritjen e ngarkes\u00ebs n\u00eb rrjet dhe paqart\u00ebsi n\u00eb munges\u00eb t\u00eb p\u00ebrgjigjeve p\u00ebr shkak t\u00eb d\u00ebshtimeve t\u00eb rrjetit, si dhe pengonte implementimin e mund\u00ebsive t\u00eb bazuara n\u00eb EDNS, si\u00e7 \u00ebsht\u00eb p\u00ebrdorimi i Cookies DNS p\u00ebr mbrojtje nga sulmet DDoS. <\/p>\n

N\u00eb vitin e ardhsh\u00ebm, \u00ebsht\u00eb vendosur t\u00eb organizohet nj\u00eb ngjarje DNS flag day 2020<\/a><\/noindex>, e cila ka p\u00ebr q\u00ebllim t\u00eb fokusohet n\u00eb zgjidhjen<\/a><\/noindex> problemi<\/a><\/noindex> me fragmentimin e IP-s\u00eb gjat\u00eb p\u00ebrpunimit t\u00eb mesazheve DNS me madh\u00ebsi t\u00eb madhe. N\u00eb kuad\u00ebr t\u00eb iniciativ\u00ebs parashihet<\/a><\/noindex> do t\u00eb rregullohen madh\u00ebsit\u00eb e rekomanduara t\u00eb bufereve p\u00ebr EDNS deri n\u00eb nivele prej 1200 byte, si dhe t\u00eb kaloj<\/a><\/noindex> procesimin e k\u00ebrkesave p\u00ebr TCP si nj\u00eb standard t\u00eb domosdosh\u00ebm n\u00eb servera. Tani mb\u00ebshtetja p\u00ebr procesimin e k\u00ebrkesave p\u00ebr UDP \u00ebsht\u00eb e detyrueshme, nd\u00ebrsa TCP \u00ebsht\u00eb e preferueshme, por jo e domosdoshme p\u00ebr funksionim (standarti parashikon mund\u00ebsin\u00eb e \u00e7aktivizimit t\u00eb TCP). Propozohet heqja e opsionit p\u00ebr \u00e7aktivizimin e TCP nga standardi dhe standardizimi i kalimit nga d\u00ebrgimi i k\u00ebrkesave p\u00ebr UDP n\u00eb p\u00ebrdorimin e TCP n\u00eb rastet kur p\u00ebrmasat e caktuara t\u00eb tamponit EDNS nuk jan\u00eb t\u00eb mjaftueshme.<\/p>\n

Ndryshimet e propozuara n\u00eb kuad\u00ebr t\u00eb nism\u00ebs do t\u00eb eliminojn\u00eb konfuzionin rreth zgjedhjes s\u00eb madh\u00ebsis\u00eb s\u00eb tamponit EDNS dhe do t\u00eb zgjidhin problemin e fraksionimit t\u00eb mesazheve t\u00eb m\u00ebdha UDP, t\u00eb cilat shpesh shkaktojn\u00eb humbje paketash dhe skadenca n\u00eb an\u00ebn e klientit. N\u00eb an\u00ebn e klientit, madh\u00ebsia e tamponit EDNS do t\u00eb jet\u00eb e q\u00ebndrueshme, nd\u00ebrsa p\u00ebrgjigjet e m\u00ebdha do t\u00eb d\u00ebrgohen menj\u00ebher\u00eb klientit p\u00ebrmes TCP. P\u00ebrjashtimi i d\u00ebrgimit t\u00eb mesazheve t\u00eb m\u00ebdha p\u00ebrmes UDP gjithashtu do t\u00eb lejoj\u00eb bllokimin e sulm<\/a><\/noindex> nga ndotja e caches DNS, q\u00eb bazohen n\u00eb manipulimin e paketa UDP t\u00eb fraksionuara (n\u00eb m\u00ebnyr\u00eb q\u00eb t\u00eb ndahen n\u00eb fraksione, fraksioni i dyt\u00eb nuk p\u00ebrfshin nj\u00eb krye me identifikuesin, prandaj mund t\u00eb p\u00ebrfakej mjaftuesh\u00ebm q\u00eb t\u00eb p\u00ebrputhet vet\u00ebm kontrolla e shum\u00ebs).<\/p>\n

N\u00eb PowerDNS Recursor 4.2 jan\u00eb marr\u00eb parasysh problemet me paketat e m\u00ebdha UDP dhe \u00ebsht\u00eb realizuar kalimi n\u00eb p\u00ebrdorimin e madh\u00ebsis\u00eb s\u00eb tamponit EDNS (edns-outgoing-bufsize) n\u00eb 1232 bajt\u00eb, n\u00eb vend t\u00eb kufizimit t\u00eb m\u00ebparsh\u00ebm prej 1680 bajt\u00ebsh, e cila duhet t\u00eb reduktoj\u00eb ndjesh\u00ebm probabilitetin e humbjes s\u00eb paketave UDP. Vlera 1232 u zgjodh sepse \u00ebsht\u00eb maksimumi, ku madh\u00ebsia e p\u00ebrgjigjes DNS n\u00eb p\u00ebrputhje me IPv6 p\u00ebrputhet me vler\u00ebn minimale MTU (1280). Po ashtu, vlera e parametrave truncation-threshold \u00ebsht\u00eb reduktuar n\u00eb 1232, e cila \u00ebsht\u00eb p\u00ebrgjegj\u00ebse p\u00ebr prerjen e p\u00ebrgjigjeve p\u00ebr klient\u00ebt.<\/p>\n

Ndryshime t\u00eb tjera n\u00eb PowerDNS Recursor 4.2:<\/p>\n