{"id":95716,"date":"2020-10-02T01:42:50","date_gmt":"2020-10-01T23:42:50","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/inicziativa-dns-flag-day-2020-dlya-resheniya-problem-s-fragmentacziej-i-podderzhkoj-tcp"},"modified":"2020-10-02T01:42:50","modified_gmt":"2020-10-01T23:42:50","slug":"inicziativa-dns-flag-day-2020-dlya-resheniya-problem-s-fragmentacziej-i-podderzhkoj-tcp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/inicziativa-dns-flag-day-2020-dlya-resheniya-problem-s-fragmentacziej-i-podderzhkoj-tcp","title":{"rendered":"DNS flag day-initiativet 2020 f\u00f6r att l\u00f6sa problem med fragmentering och st\u00f6d f\u00f6r TCP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Idag kommer flera stora DNS-tj\u00e4nster och tillverkare av DNS-servrar att genomf\u00f6ra ett gemensamt evenemang DNS flag day 2020<\/a><\/noindex>, som syftar till att fokusera uppm\u00e4rksamheten p\u00e5 l\u00f6sningen<\/a><\/noindex> av problem<\/a><\/noindex> med IP-fragmentering vid behandling av stora DNS-meddelanden. Detta \u00e4r den andra liknande h\u00e4ndelsen, efter f\u00f6rra \u00e5rets \"DNS flag day\" inriktad<\/a><\/noindex> p\u00e5 korrekt hantering av EDNS-f\u00f6rfr\u00e5gningar. <\/p>\n

Deltagarna i DNS flag day-initiativet 2020 uppmanar att fastst\u00e4lla de rekommenderade bufferstorlekarna f\u00f6r EDNS till niv\u00e5er p\u00e5 1232 byte (MTU-storlek p\u00e5 1280 minus 48 byte f\u00f6r rubriker), och att \u00f6vers\u00e4tta<\/a><\/noindex> hanteringen av f\u00f6rfr\u00e5gningar \u00f6ver TCP till en obligatorisk funktion p\u00e5 servrar. I RFC 1035<\/a><\/noindex> \u00e4r endast st\u00f6d f\u00f6r hantering av f\u00f6rfr\u00e5gningar via UDP obligatoriskt, och TCP anges som \u00f6nskv\u00e4rt men icke obligatoriskt f\u00f6r driften. Nya RFC 7766<\/a><\/noindex> och RFC 5966<\/a><\/noindex> omfattar tydligt TCP som en av de obligatoriska funktionerna som kr\u00e4vs f\u00f6r korrekt DNS-funktion. Inom ramen f\u00f6r det genomf\u00f6rda initiativet f\u00f6resl\u00e5s att \u00f6verg\u00e5ngen fr\u00e5n att skicka f\u00f6rfr\u00e5gningar via UDP till att anv\u00e4nda TCP tvingas i de fall d\u00e4r den angivna bufferstorleken f\u00f6r EDNS \u00e4r otillr\u00e4cklig.<\/p>\n

De f\u00f6reslagna f\u00f6r\u00e4ndringarna kommer att eliminera f\u00f6rvirringen med att v\u00e4lja bufferstorleken f\u00f6r EDNS och l\u00f6sa problemet med fragmentering av stora UDP-meddelanden, vars hantering ofta leder till paketf\u00f6rlust och tidsgr\u00e4nser p\u00e5 klientsidan. P\u00e5 klientsidan kommer bufferstorleken f\u00f6r EDNS att vara konstant, och stora svar kommer att skickas till klienten via TCP omedelbart. Undantaget f\u00f6r att skicka stora meddelanden via UDP kommer ocks\u00e5 att l\u00f6sa problem med avvisning av stora paket p\u00e5 vissa brandv\u00e4ggar och m\u00f6jligg\u00f6ra blockering av attacker<\/a><\/noindex> mot DNS-cachef\u00f6rgiftning som \u00e4r baserade p\u00e5 manipulation av fragmenterade UDP-paket (vid fragmentering, inkluderas inte rubriken med identifierare i det andra fragmentet, vilket g\u00f6r att det kan f\u00f6rfalskas s\u00e5 l\u00e4nge kontrollsumman st\u00e4mmer).<\/p>\n

Fr\u00e5n och med idag kommer de DNS-leverant\u00f6rer som deltar i initiativet, inklusive CloudFlare, Quad 9, Cisco (OpenDNS) och Google, gradvis att f\u00f6r\u00e4ndras<\/a><\/noindex> storleken p\u00e5 EDNS-bufferten \u00e4ndras fr\u00e5n 4096 till 1232 byte p\u00e5 sina DNS-servrar (\u00e4ndringen av EDNS kommer att str\u00e4cka sig \u00f6ver 4-6 veckor och gradvis omfatta fler och fler f\u00f6rfr\u00e5gningar). Svar p\u00e5 UDP-f\u00f6rfr\u00e5gningar som inte passar inom den nya begr\u00e4nsningen kommer att skickas via TCP. Tillverkare av DNS-servrar, inklusive BIND, Unbound, Knot, NSD och PowerDNS kommer att sl\u00e4ppa uppdateringar som \u00e4ndrar den standard EDNS-buffertstorleken fr\u00e5n 4096 till 1232 byte. <\/p>\n

I slut\u00e4ndan kan de f\u00f6reslagna f\u00f6r\u00e4ndringarna leda till problem med uppl\u00f6sning vid kontakt med DNS-servrar vars DNS-svar \u00f6verstiger 1232 byte \u00f6ver UDP och som inte kan skicka svar \u00f6ver TCP. Ett experiment genomf\u00f6rt av Google visade att en f\u00f6r\u00e4ndring av EDNS-buffertstorleken knappt p\u00e5verkar felprocenten \u2014 med en buffert p\u00e5 4096 byte \u00e4r antalet avskurna UDP-f\u00f6rfr\u00e5gningar 0,345 %, medan antalet odelade upprepade svar \u00f6ver TCP \u00e4r 0,115 %. Med en buffert p\u00e5 1232 byte \u00e4r dessa siffror 0,367 % och 0,116 %. \u00d6verg\u00e5ngen till obligatorisk TCP-support i DNS kommer att leda till problem med interaktionen med cirka 0,1 % av DNS-servrarna. Det noteras att under moderna f\u00f6rh\u00e5llanden \u00e4r dessa servrar redan instabila utan TCP.<\/p>\n

Administrat\u00f6rer av auktoritativa DNS-servrar b\u00f6r s\u00e4kerst\u00e4lla att deras server svarar via TCP p\u00e5 n\u00e4tverksport 53 och att denna TCP-port inte blockeras av en brandv\u00e4gg. En auktoritativ DNS-server ska heller inte skicka UDP-svar vars storlek \u00f6verskrider
\nbeg\u00e4rd EDNS-buffertstorlek. P\u00e5 sj\u00e4lva servern b\u00f6r EDNS-buffertstorleken s\u00e4ttas till 1232 byte. Resolverna st\u00e4lls inf\u00f6r ungef\u00e4r samma krav \u2014 obligatorisk m\u00f6jlighet att svara \u00f6ver TCP, obligatorisk support f\u00f6r att skicka omf\u00f6rfr\u00e5gningar \u00f6ver TCP vid mottagande av avskurna UDP-svar och inst\u00e4llning av EDNS-bufferten till 1232 byte.<\/p>\n

F\u00f6ljande parametrar ansvarar f\u00f6r inst\u00e4llningen av EDNS-buffertstorleken p\u00e5 olika DNS-servrar:<\/p>\n

  • BIND\n

    options {
    \n edns-udp-size 1232;
    \n max-udp-size 1232;
    \n };<\/p>\n

  • Knot DNS\n

    max-udp-payload: 1232<\/p>\n

  • Knot Resolver\n

    net.bufsize(1232)<\/p>\n

  • PowerDNS Authoritative\n

    udp-truncation-threshold=1232<\/p>\n

  • PowerDNS Recursor\n

    edns-outgoing-bufsize=1232
    \n udp-truncation-threshold=1232<\/p>\n

  • Unbound\n

    edns-buffer-size: 1232<\/p>\n

  • NSD\n

    ipv4-edns-size: 1232
    \n ipv6-edns-size: 1232<\/p>\n

    <\/a><\/noindex><\/p>\n

    K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u0440\u044f\u0434 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 DNS-\u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043f\u0440\u043e\u0432\u0435\u0434\u0443\u0442 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0435 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0435 DNS flag day 2020, \u043f\u0440\u0438\u0437\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u0444\u043e\u043a\u0443\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0440\u0435\u0448\u0435\u043d\u0438\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 IP-\u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 DNS-\u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u0431\u043e\u043b\u044c\u0448\u043e\u0433\u043e \u0440\u0430\u0437\u043c\u0435\u0440\u0430. \u042d\u0442\u043e \u0432\u0442\u043e\u0440\u043e\u0435 \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0435 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0435, \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 «DNS flag day» \u0431\u044b\u043b \u0441\u043e\u0441\u0440\u0435\u0434\u043e\u0442\u043e\u0447\u0435\u043d \u043d\u0430 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 EDNS. \u0423\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u0438 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u044b DNS flag day 2020 \u043f\u0440\u0438\u0437\u044b\u0432\u0430\u044e\u0442 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0440\u0430\u0437\u043c\u0435\u0440\u044b \u0431\u0443\u0444\u0435\u0440\u043e\u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-95716","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47DNS flag day 2020-initiativ f\u00f6r att l\u00f6sa problem med fragmentering och TCP-st\u00f6d | ProHoster","description":"Idag kommer en rad stora DNS-tj\u00e4nster och tillverkare av DNS-servrar att genomf\u00f6ra ett gemensamt evenemang DNS flag day 2020, som syftar till att fokusera.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/inicziativa-dns-flag-day-2020-dlya-resheniya-problem-s-fragmentacziej-i-podderzhkoj-tcp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u0430 DNS flag day 2020 \u0434\u043b\u044f \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0435\u0439 \u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u043e\u0439 TCP | ProHoster","og:description":"\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u0440\u044f\u0434 \u043a\u0440\u0443\u043f\u043d\u044b\u0445 DNS-\u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043f\u0440\u043e\u0432\u0435\u0434\u0443\u0442 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0435 \u043c\u0435\u0440\u043e\u043f\u0440\u0438\u044f\u0442\u0438\u0435 DNS flag day 2020, \u043f\u0440\u0438\u0437\u0432\u0430\u043d\u043d\u043e\u0435 \u0441\u0444\u043e\u043a\u0443\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/inicziativa-dns-flag-day-2020-dlya-resheniya-problem-s-fragmentacziej-i-podderzhkoj-tcp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-01T23:42:50+00:00","article:modified_time":"2020-10-01T23:42:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"95716","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:59:41","updated":"2022-10-02 16:18:32","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/95716","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=95716"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/95716\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=95716"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=95716"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=95716"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}