Zhvilluesit e serverit DNS BIND njoftuan p\u00ebr shtimin n\u00eb deg\u00ebn eksperimentale 9.17 t\u00eb mb\u00ebshtetjes s\u00eb serverit p\u00ebr teknologjit\u00eb \u00abDNS mbi HTTPS\u00bb (DoH, DNS over HTTPS) dhe DNS mbi TLS (DoT, DNS over TLS), si dhe mekanizmin XFR-over-TLS p\u00ebr transferimin e sigurt t\u00eb p\u00ebrmbajtjes s\u00eb zonave DNS midis server\u00ebve. DoH \u00ebsht\u00eb e disponueshme p\u00ebr testim n\u00eb l\u00ebshimin 9.17.10, nd\u00ebrsa mb\u00ebshtetja DoT \u00ebsht\u00eb e pranishme q\u00eb nga l\u00ebshimi 9.17.7. Pas stabilizimit, mb\u00ebshtetja DoT dhe DoH do t\u00eb importohet n\u00eb deg\u00ebn e stabilizuar 9.16. <\/p>\n
Zbatimi i protokollit HTTP\/2, i p\u00ebrdorur n\u00eb DoH, bazohet n\u00eb p\u00ebrdorimin e bibliotek\u00ebs nghttp2, e cila \u00ebsht\u00eb e p\u00ebrfshir\u00eb n\u00eb var\u00ebsit\u00eb e nd\u00ebrtimit (n\u00eb t\u00eb ardhmen, biblioteka planifikohet t\u00eb transferohet n\u00eb var\u00ebsi jo t\u00eb detyrueshme). Mb\u00ebshteten si lidhje t\u00eb enkriptuara (TLS), ashtu edhe t\u00eb paenkriptuara p\u00ebrmes HTTP\/2. Me konfigurimet e duhura, nj\u00eb proces named tani mund t\u00eb sh\u00ebrbej\u00eb jo vet\u00ebm k\u00ebrkesat tradicionale DNS, por edhe k\u00ebrkesat e d\u00ebrguara duke p\u00ebrdorur DoH (DNS-over-HTTPS) dhe DoT (DNS-over-TLS). Mb\u00ebshtetja HTTPS n\u00eb an\u00ebn e klientit (dig) ende nuk \u00ebsht\u00eb zbatuar. mb\u00ebshtetja XFR-over-TLS \u00ebsht\u00eb n\u00eb dispozicion si p\u00ebr k\u00ebrkesat hyr\u00ebse ashtu edhe p\u00ebr ato dal\u00ebse. <\/p>\n
Trajtimi i k\u00ebrkesave duke p\u00ebrdorur DoH dhe DoT aktivizohet duke shtuar opsionet http dhe tls n\u00eb direktiv\u00ebn listen-on. P\u00ebr mb\u00ebshtetje t\u00eb DNS-over-HTTP pa enkriptim, n\u00eb konfigurim duhet t\u00eb specifikohet \u00abtls none\u00bb. \u00c7el\u00ebsat p\u00ebrcaktohen n\u00eb seksionin \u00abtls\u00bb. Portet standarde t\u00eb rrjetit 853 p\u00ebr DoT, 443 p\u00ebr DoH dhe 80 p\u00ebr DNS-over-HTTP mund t\u00eb rinegocohen p\u00ebrmes parametrave tls-port, https-port dhe http-port. P\u00ebr shembull: tls local-tls { key-file \u00ab\/path\/to\/priv_key.pem\u00bb; cert-file \u00ab\/path\/to\/cert_chain.pem\u00bb; }; http local-http-server { endpoints { \u00ab\/dns-query\u00bb; }; }; options { https-port 443; listen-on port 443 tls local-tls http myserver {any;}; } <\/p>\n
Nga ve\u00e7orit\u00eb e zbatimit t\u00eb DoH n\u00eb BIND, v\u00ebrehet integrimi si nj\u00eb transport i p\u00ebrbashk\u00ebt, i cili mund t\u00eb p\u00ebrdoret jo vet\u00ebm p\u00ebr p\u00ebrpunimin e k\u00ebrkesave t\u00eb klient\u00ebve n\u00eb rezolutor, por edhe kur shk\u00ebmbehen t\u00eb dh\u00ebna mes server\u00ebve, gjat\u00eb transferimit t\u00eb zonave nga serveri DNS autoritativ dhe gjat\u00eb p\u00ebrpunimit t\u00eb \u00e7do k\u00ebrkese, t\u00eb mb\u00ebshtetur nga transportet e tjera DNS. <\/p>\n
Nj\u00eb ve\u00e7ori tjet\u00ebr \u00ebsht\u00eb mund\u00ebsia e transferimit t\u00eb operacioneve t\u00eb enkripcionit p\u00ebr TLS n\u00eb nj\u00eb server tjet\u00ebr, di\u00e7ka q\u00eb mund t\u00eb jet\u00eb e nevojshme kur certifikatat TLS ruhen n\u00eb nj\u00eb sistem tjet\u00ebr (p.sh., n\u00eb infrastruktur\u00ebn me server\u00eb web) dhe p\u00ebrpunohen nga nj\u00eb stafe tjet\u00ebr. Mb\u00ebshtetja p\u00ebr DNS t\u00eb pamaskuar mbi HTTP \u00ebsht\u00eb implementuar p\u00ebr t\u00eb thjeshtuar debuggimin dhe si nj\u00eb nivel p\u00ebr kalimin n\u00eb rrjetin e brendsh\u00ebm, mbi t\u00eb cilin n\u00eb nj\u00eb server tjet\u00ebr mund t\u00eb organizohet enkripcion. N\u00eb serverin e jasht\u00ebm p\u00ebr formimin e trafikut TLS mund t\u00eb p\u00ebrdoret nginx, si\u00e7 organizohet mb\u00ebshtetje HTTPS p\u00ebr faqet. <\/p>\n
Kujtojm\u00eb se DNS-i mbi HTTPS mund t\u00eb jet\u00eb i dobish\u00ebm p\u00ebr t\u00eb shmangur rrjedhjet e informacionit mbi emrat e hosteve t\u00eb k\u00ebrkuar p\u00ebrmes server\u00ebve DNS t\u00eb ofruesve, p\u00ebr t\u00eb luftuar sulmet MITM dhe p\u00ebr t\u00eb falsifikuar trafikun DNS (p.sh., kur lidhemi me Wi-Fi publik), p\u00ebr t\u00eb p\u00ebrballuar bllokimet n\u00eb nivelin DNS (DNS mbi HTTPS nuk mund t\u00eb z\u00ebvend\u00ebsoj\u00eb VPN<\/a> n\u00eb fush\u00ebn e shmangies s\u00eb bllokimeve, t\u00eb realizuara n\u00eb nivelin DPI) ose p\u00ebr t\u00eb organizuar pun\u00ebn n\u00eb rastin e pamund\u00ebsis\u00eb p\u00ebr t'u drejtuar direkt n\u00eb server\u00ebt DNS (p.sh., kur punojm\u00eb p\u00ebrmes nj\u00eb proksi). N\u00eb situat\u00ebn normale, k\u00ebrkesat DNS d\u00ebrgohen drejtp\u00ebrdrejt n\u00eb server\u00ebt DNS t\u00eb caktuar n\u00eb konfigurimin e sistemit, nd\u00ebrsa n\u00eb rastin e DNS-it mbi HTTPS, k\u00ebrkesa p\u00ebr p\u00ebrcaktimin Adresa IP<\/a> e hostit inkapsulohet n\u00eb trafik HTTPS dhe d\u00ebrgohet n\u00eb nj\u00eb server HTTP, ku rezolvuesi p\u00ebrpunon k\u00ebrkesat p\u00ebrmes Web API. <\/p>\n