Raac weydiinta DNS tallaabo tallaabo si aad u hesho isha dhabta ah
Cinwaanka resolver-ka ee la riixo ma go'aaminayo isha uu resolver-ku arko. Raac macmiilka, gudbiyaha iyo server-ka qaata, kadib qor wadada.
Macmiilka siinta cinwaanka resolver-ka waxay go'aamisaa halka weydiimaha loo diro, ma aha isha uu resolver-ku arki doono. Dariiqa, gudbinta iyo tarjumaadda mid kastaa wuxuu leeyahay waqti u gaar ah inta u dhaxaysa labada daraf. Buugga habraaca ee su'aalaha isha wuxuu raacaa weydiinta tallaabo tallaabo wuxuuna qoraa waxa ay goobjooge kastaa dhab ahaan arkay. Nidaamka ayaa muhiim ah, sababtoo ah sheegashada la sameeyay ka hor indha-indhaynta waa uun mala-awaal qaab wanaagsan.
Qor habaynta ka hor inta aadan ururin caddaymo
Afar meelood ayaa wax kaaga sheegi kara isha DNS, mana wada sheegaan isla wax. Kernel-ka macmiilka wuu ogyahay isha uu isticmaali lahaa, gudbiyuhu wuu ogyahay waxa uu kor u diray, qalabka tarjumaadda wuu ogyahay waxa uu dib u qoray, resolver-ka qaata wuu ogyahay waxa yimid. Qor kuwaad dhab ahaan gaari karto ka hor inta aadan wax ururin.
| Observation point | What it can prove | What it cannot prove | How to read it |
|---|---|---|---|
| client kernel | which source address it would use for that resolver | anything a device in between rewrote | ip route get against the resolver address |
| forwarder | that it sent an upstream query, and from which source | what the client originally asked for | its own log and its cache state |
| translating device | that a source was rewritten, and to what | whether the query was legitimate | NAT policy and its counters |
| receiving resolver | the address that actually arrived | which client behind that address asked | a scoped capture on port 53 |
Qor sidoo kale waxa aad filanayso, oo ay ku jirto resolver-ka aad u malaynayso in la isticmaalayo. Waddo kala qaybsan ayaa weydiinta u diri karta meel gebi ahaan kale, keydku wuxuu u jawaabi karaa isdhaaf la'aan kor ah, sidaas darteed malo-awaalka maskaxda kaliya lagu hayo ma ka badbaaday doono yaabka ugu horreeya. Hayso naqshadda la sheegay iyo waddada la arkay ee tiirar kala duwan oo isla qoraal ah; marka labada aan is waafaqsanayn, waxaad heshay su'aasha mudan in la raaco.
Hubi hawsha kee ayaa dhab ahaan diray weydiinta
Ka bilow macmiilka: qor cinwaanka resolver-ka, magaca weydiinta iyo waqtiga, kadib xaqiiji hawsha kee ayaa diray. Sadarka ugu horreeya ee hoose wuxuu magacaabaa hawsha haysata socket-ka UDP, waana taas hubinta cinwaankan u ballanqaaday. Haddii hawshaasi ay tahay kaaliyaha browser-ka ama deegaanka fulinta konteenarka halkii ay ahaan lahayd resolver-ka nidaamka, raadka intiisa kale wuxuu sharraxayaa waddo aan cidina weydiisan.
ss -tunp 'dport = :53'
dig @10.20.30.53 host.corp.example +noall +answer
ip route get 10.20.30.53Host leh dhowr interface, marka hore ogaado cinwaanka isha ee kernel-ku u doorto bartankaas ka hor inta aadan meel kale eegin. Taasi waa barta ugu dambaysa ee waddadu si buuxda gacantaada ugu jirto, waana qiimaha aad la barbardhigi doonto waxa resolver-ku soo sheego. Is-waafaqi la'aantu waa calaamad muujinaysa in wax dhexdhexaad ah uu dib u qoray baakadda, ama laba weydiin oo kala duwan la diray.
Hay magacyada tijaabada gudaha, sababtoo ah magac gudaha ah oo loo diro resolver dadweyne waxba kama caddaynayo waddada gudaha wuxuuna daabacaa magac aadan u baahnayn inaad daabacdo. Browser leh DNS ammaan oo shidan ayaa gebi ahaan kama soo muuqan doono liiskaas socket-ka, maqnaanshahaasina waa jawaabta lafteeda.
Gudbiyuhu wuxuu sameeyaa weydiin labaad oo gaar ah
Gudbiyuhu wuxuu hal isdhaaf u beddelaa laba. Codsiga hoose wuu yimaadaa, kadib gudbiyuhu wuxuu weydiintiisa kor u diraa cinwaan uu isagu doorto. Habayntiisa, ma aha macmiilka, ayaa go'aamisa waxa resolver-ka sare arko.
buugga dnsmasq waa mudan in la akhriyo sababtaas: wuxuu sharraxayaa sida gudbiyuhu u doorto server-yada sare iyo sida uu u xiro dhinaca dhegeysiga, waxna kama jiro habayntaas oo isha macmiilka kor u qaada. Sidaas darteed log resolver oo muujinaya cinwaanka gateway waa caadi, ma aha caddayn cilad. Maqnaanshaha sidoo kale waa sahlan tahay in si khaldan loo akhriyo, sababtoo ah ku dhufashada keydka ma abuurto wax weydiin kor ah oo waxay u eg tahay si isku mid ah weydiin aan waligeed iman. Akhri habaynta gudbiyaha iyo xaaladda keydkiisa ka hor inta aadan qaadan mid ka mid ah labada gabagabo. Laba su'aal, laba meelood oo la eego.
Akhri isha resolver-ka qaata
Indha-indhaynta kaliya ee tan xallisa waxaa laga qaataa dhinaca server-ka. Wax kasta oo laga soo saaro liiska interface-ka macmiilka waxay ahaanayaan mala-awaal ilaa resolver-ku soo sheego waxa dhab ahaan yimid.
tcpdump -ni any port 53 and host 10.20.30.53Qabo host-ka resolver-ka, hay qabashada mid gaaban oo xaddidan, oo ku kaydi meesha siyaasaddu u ogolaato. Haddii isha la arkay ay tahay cinwaan la tarjumay, su'aasha xigta waa qalabkee ayaa tarjumaadda sameeyay iyo in siyaasaddiisu tahay tii loogu talagalay. Qabashadu waxay ka jawaabtaa waxa yimid; ma sharraxayso sababta siyaasaddu u ogolaatay. Magacaab goobjoogaha iyo tallaabada qoraalka, sababtoo ah sheegashada asturnaanta ee ku saabsan gateway waa sheegasho ku saabsan tallaabadaas, ma aha waddada oo dhan.
Qor natiijada sida waddo, ma aha sida cinwaan
Qor macmiilka, resolver-ka, gudbiye kasta, isha la arkay tallaabo kasta iyo siyaasadda maamusha. Diiwaankaas wuxuu ka jawaabaa su'aalaha mustaqbalka intooda badan iyada oo aan la qaban wax kale. U sawir sida silsilad, sababtoo ah liiska cinwaannada wuxuu qariyaa tallaabada kee ayaa soo saartay kee.
Ku lifaaq sawirka taariikhda, nooca macmiilka iyo dib u eegista habaynta, si akhriste dambe uu u sheegi karo haddii ay weli khuseeyso. Ka sooc isha gaadiidka wax kasta oo kale oo adeeggu ka shaqeeyo, sababtoo ah aragtida cinwaanka gateway waxba kama sheegayo waxa kale ee la kaydiyo. Goobta resolver-kuna waxba kama sheegto macmiilkee ayaa weydiiyay. Kala soocidda sheegashooyinkaas ayaa ka dhigta gabagabada mid difaacmi karo marka dib loo eego.