Zhvilluesit e serverit DNS BIND njoftuan p\u00ebr shtimin n\u00eb deg\u00ebn eksperimentale 9.17 t\u00eb implementimit t\u00eb mb\u00ebshtetjes serverore p\u00ebr teknologjit\u00eb \u00abDNS mbi HTTPS\u00bb (DoH, DNS mbi HTTPS) dhe DNS mbi TLS (DoT, DNS mbi TLS), si dhe mekanizmin XFR-over-TLS p\u00ebr transferimin n\u00eb m\u00ebnyr\u00eb t\u00eb sigurt t\u00eb p\u00ebrmbajtjes s\u00eb zonave DNS midis server\u00ebve. DoH \u00ebsht\u00eb n\u00eb dispozicion p\u00ebr testim n\u00eb l\u00ebshimin 9.17.10, nd\u00ebrsa mb\u00ebshtetja p\u00ebr DoT \u00ebsht\u00eb e pranishme q\u00eb nga l\u00ebshimi 9.17.7. Pas stabilizimit, mb\u00ebshtetja p\u00ebr DoT dhe DoH do t\u00eb zbatohet n\u00eb deg\u00ebn stabile 9.16. <\/p>\n
Implementimi i protokollit HTTP\/2, i p\u00ebrdorur n\u00eb DoH, bazohet n\u00eb p\u00ebrdorimin e bibliotek\u00ebs nghttp2, e cila p\u00ebrfshihet n\u00eb list\u00ebn e var\u00ebsive t\u00eb nd\u00ebrtimit (n\u00eb t\u00eb ardhmen, biblioteka planifikohet t\u00eb kalohet n\u00eb var\u00ebsi opcionale). Mb\u00ebshteten si lidhje t\u00eb enkriptuara (TLS), ashtu edhe lidhje t\u00eb paenkriptuara mbi HTTP\/2. Me konfigurime t\u00eb p\u00ebrshtatshme, nj\u00eb proces named tani mund t\u00eb sh\u00ebrbej\u00eb jo vet\u00ebm k\u00ebrkesat tradicionale t\u00eb DNS, por edhe k\u00ebrkesat e d\u00ebrguara duke p\u00ebrdorur DoH (DNS-over-HTTPS) dhe DoT (DNS-over-TLS). Mb\u00ebshtetja p\u00ebr HTTPS n\u00eb an\u00ebn e klientit (dig) aktualisht nuk \u00ebsht\u00eb implementuar. Mb\u00ebshtetje p\u00ebr XFR-over-TLS \u00ebsht\u00eb n\u00eb dispozicion si p\u00ebr k\u00ebrkesat hyr\u00ebse, ashtu edhe p\u00ebr ato dal\u00ebse. <\/p>\n
P\u00ebrpunimi i k\u00ebrkesave duke p\u00ebrdorur DoH dhe DoT aktivizohet p\u00ebrmes shtimit t\u00eb opsioneve http dhe tls n\u00eb direktiv\u00ebn listen-on. P\u00ebr t\u00eb mb\u00ebshtetur DNS-over-HTTP t\u00eb paenkriptuar n\u00eb konfigurime, duhet t\u00eb jepet \u00abtls none\u00bb. \u00c7el\u00ebsat p\u00ebrcaktohen n\u00eb seksionin \u00abtls\u00bb. Portet standarde t\u00eb rrjetit 853 p\u00ebr DoT, 443 p\u00ebr DoH dhe 80 p\u00ebr DNS-over-HTTP mund t\u00eb tejkalohen p\u00ebrmes parametrave tls-port, https-port dhe http-port. P\u00ebr shembull: tls local-tls { key-file \u00ab\/path\/to\/priv_key.pem\u00bb; cert-file \u00ab\/path\/to\/cert_chain.pem\u00bb; }; http local-http-server { endpoints { \u00ab\/dns-query\u00bb; }; }; options { https-port 443; listen-on port 443 tls local-tls http myserver {any;}; } <\/p>\n
Nga ve\u00e7orit\u00eb e implementimit t\u00eb DoH n\u00eb BIND, vihet n\u00eb dukje integrimi si nj\u00eb transport i zakonsh\u00ebm, i cili mund t\u00eb p\u00ebrdoret jo vet\u00ebm p\u00ebr p\u00ebrpunimin e k\u00ebrkesave t\u00eb klient\u00ebve ndaj zgjidh\u00ebsit, por edhe gjat\u00eb shk\u00ebmbimit t\u00eb t\u00eb dh\u00ebnave midis server\u00ebve, n\u00eb transferimin e zonave nga serveri autoritativ DNS dhe gjat\u00eb p\u00ebrpunimit t\u00eb \u00e7do k\u00ebrkese t\u00eb mb\u00ebshtetur nga transportet e tjera t\u00eb DNS. <\/p>\n
Nj\u00eb ve\u00e7ori tjet\u00ebr \u00ebsht\u00eb mund\u00ebsia e transferimit t\u00eb operacioneve t\u00eb enkriptimit p\u00ebr TLS n\u00eb nj\u00eb server tjet\u00ebr, e cila mund t\u00eb jet\u00eb e nevojshme kur ruajti TLS-sertifikatat n\u00eb nj\u00eb sistem tjet\u00ebr (p\u00ebr shembull, n\u00eb infrastruktur\u00ebn me web-servera) dhe mb\u00ebshtetet nga nj\u00eb personel tjet\u00ebr. Mb\u00ebshtetje p\u00ebr DNS-over-HTTP t\u00eb paenkriptuar \u00ebsht\u00eb realizuar p\u00ebr t\u00eb thjeshtuar debugging-un dhe si nj\u00eb nivel p\u00ebr kalimin n\u00eb rrjetin e brendsh\u00ebm, mbi t\u00eb cilin mund t\u00eb organizohet enkriptimi n\u00eb nj\u00eb server tjet\u00ebr. Nj\u00eb server i ve\u00e7ant\u00eb mund t\u00eb p\u00ebrdoret p\u00ebr formimin e trafikut TLS me nginx, nj\u00ebsoj si\u00e7 organizohet mb\u00ebshtjellja HTTPS p\u00ebr faqet e internetit. <\/p>\n
Kujtojm\u00eb se DNS-over-HTTPS mund t\u00eb jet\u00eb e dobishme p\u00ebr t\u00eb eliminuar rrjedhjen e informacioneve rreth emrave t\u00eb hosteve q\u00eb k\u00ebrkohen p\u00ebrmes server\u00ebve DNS t\u00eb ofruesve, p\u00ebr t\u00eb luftuar sulmet MITM dhe nd\u00ebrrimin e trafikut DNS (p\u00ebr shembull, gjat\u00eb lidhjes me Wi-Fi publike), dhe p\u00ebr t'u p\u00ebrballur me bllokimet n\u00eb nivel DNS (DNS-over-HTTPS nuk mund t\u00eb z\u00ebvend\u00ebsoj\u00eb) VPN<\/a> n\u00eb fush\u00ebn e anashkalimit t\u00eb bllokimeve q\u00eb zbatohen n\u00eb nivelin DPI) ose p\u00ebr t\u00eb organizuar funksionimin n\u00eb rastin e pamund\u00ebsis\u00eb p\u00ebr t'u drejtuar drejp\u00ebrdrejt te server\u00ebt DNS (p.sh., kur punoni p\u00ebrmes nj\u00eb prokse). N\u00eb nj\u00eb situat\u00eb normale, k\u00ebrkesat DNS d\u00ebrgohen drejtp\u00ebrdrejt te server\u00ebt DNS t\u00eb caktuar n\u00eb konfigurimin e sistemit, nd\u00ebrsa n\u00eb rastin e DNS-over-HTTPS, k\u00ebrkesa p\u00ebr p\u00ebrcaktimin adresat IP<\/a> e hostit inkorporohet n\u00eb trafikun HTTPS dhe d\u00ebrgohet n\u00eb serverin HTTP, n\u00eb t\u00eb cilin rezolvuesi p\u00ebrpunon k\u00ebrkesat p\u00ebrmes Web API. <\/p>\n