Classless in-addr.arpa delegation broken #123

Closed
Habbie opened this Issue Apr 26, 2013 · 2 comments

Projects

None yet

1 participant

@Habbie
Member
Habbie commented Apr 26, 2013

It seems in certain cases PowerDNS does not volunteer the CNAME it has
when asked for a PTR; which will break sites with rfc2317
(http://www.ietf.org/rfc/rfc2317.txt) setup.

We are running r950 out of the SVN trunk with a patch for #118
(http://wiki.powerdns.com/cgi-bin/trac.fcgi/ticket/118).

So for example we have a BIND master with a zone file that looks
something like this:

$TTL 3600
$ORIGIN 222.12.69.in-addr.arpa.
@               IN      SOA     sonic.net. hostmaster.sonic.net. (
                       2006121401      ; serial
                       3600            ; refresh
                       300             ; retry
                       1209600          ; expire
                       3600 )          ; minimum ttl
               IN      NS      a.auth-ns.sonic.net.
               IN      NS      b.auth-ns.sonic.net.
               IN      NS      c.auth-ns.sonic.net.
0-255           IN      NS      ns1.quantact.com.
0-255           IN      NS      ns2.quantact.com.
2               IN      CNAME   2.0-255.222.12.69.in-addr.arpa.

If you ask the BIND master for the reverse you get the CNAME and glue records:

[augie@augnix ~]$ dig -x 69.12.222.2 @mns1.sonic.net +norecurse
;; ANSWER SECTION:
2.222.12.69.in-addr.arpa. 3600  IN      CNAME   2.0-255.222.12.69.in-addr.arpa.
;; AUTHORITY SECTION:
0-255.222.12.69.in-addr.arpa. 3600 IN   NS      ns1.quantact.com.
0-255.222.12.69.in-addr.arpa. 3600 IN   NS      ns2.quantact.com.
;; ADDITIONAL SECTION:
ns1.quantact.com.       172121  IN      A       64.142.109.250
ns2.quantact.com.       172121  IN      A       64.151.119.219

But if you ask one of the PowerDNS authoritative slaves you only get the glue:

[augie@augnix ~]$ dig -x 69.12.222.2 @a.auth-ns.sonic.net +norecurse
;; AUTHORITY SECTION:
0-255.222.12.69.in-addr.arpa. 3600 IN   NS      ns1.quantact.com.
0-255.222.12.69.in-addr.arpa. 3600 IN   NS      ns2.quantact.com.

The pertinent bits in the PowerDNS slave DBs look like this:

mysql> select name,type,content from records where domain_id = 17603
and type = 'NS';
+------------------------------+------+---------------------+
| name                         | type | content             |
+------------------------------+------+---------------------+
| 222.12.69.in-addr.arpa       | NS   | a.auth-ns.sonic.net |
| 222.12.69.in-addr.arpa       | NS   | b.auth-ns.sonic.net |
| 222.12.69.in-addr.arpa       | NS   | c.auth-ns.sonic.net |
| 0-255.222.12.69.in-addr.arpa | NS   | ns1.quantact.com    |
| 0-255.222.12.69.in-addr.arpa | NS   | ns2.quantact.com    |
+------------------------------+------+---------------------+

and

mysql> select name,type,content from records where content =
'2.0-255.222.12.69.in-addr.arpa';
+--------------------------+-------+--------------------------------+
| name                     | type  | content                        |
+--------------------------+-------+--------------------------------+
| 2.222.12.69.in-addr.arpa | CNAME | 2.0-255.222.12.69.in-addr.arpa |
+--------------------------+-------+--------------------------------+
@Habbie Habbie was assigned Apr 26, 2013
@Habbie Habbie closed this Apr 26, 2013
@Habbie
Member
Habbie commented Apr 26, 2013

Attachment 'BIND zone file of affected zone.' (db.69.12.222) https://gist.github.com/5466608

@Habbie
Member
Habbie commented Apr 26, 2013

Author: ahu
fixed in 992, but I wonder if this ends things. The regression tests don't find anything odd.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment