Bug 1470637

Summary: nslookup and dig return SERVFAIL error for FQDN after multiple queries
Product: Red Hat Enterprise Linux 7 Reporter: Tomáš Hozza <thozza>
Component: bindAssignee: Petr Menšík <pemensik>
Status: CLOSED ERRATA QA Contact: Petr Sklenar <psklenar>
Severity: high Docs Contact:
Priority: high    
Version: 7.4CC: pemensik, psklenar, qe-baseos-daemons, sshaurya, thozza
Target Milestone: rcKeywords: Patch
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: bind-9.9.4-54.el7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: 1449814 Environment:
Last Closed: 2018-04-10 11:56:55 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1449814    
Bug Blocks: 1420851, 1465928    
Attachments:
Description Flags
Keep origin on new TCP connection patch
none
tests for dig
none
Retry again with origin after TCP timeout. none

Comment 2 Petr Menšík 2017-08-22 14:34:19 UTC
Fix acknowledged but modified.

https://bugs.isc.org/Public/Bug/Display.html?id=45547

Comment 3 Petr Menšík 2017-08-22 15:08:24 UTC
Created attachment 1316676 [details]
Keep origin on new TCP connection patch

Comment 7 Petr Menšík 2017-10-11 19:32:57 UTC
Found out part of this problem is made by RHEL specific path, created by commit http://pkgs.devel.redhat.com/cgit/rpms/bind/commit/?id=61b073aa6a5fcf448ffd3a18970c38e4eaef1284

I could not find a bug that it solved. It will try next search domain or root if no reply arrives. Because stock dig does not have such feature and it would receive SERVFAILs again, removing this feature. Only then it will pass upstream tests.

Correct lookup for any name can be done by appending dot after relative name, making it absolute.

Comment 8 Petr Menšík 2017-10-11 19:34:05 UTC
Created attachment 1337400 [details]
tests for dig

Comment 9 Petr Menšík 2017-10-11 19:37:48 UTC
Created attachment 1337404 [details]
Retry again with origin after TCP timeout.

Do not change origin without reply from a server.

Comment 13 Petr Menšík 2017-10-12 13:48:10 UTC
Mentioned patch nslookup-norec.patch were dropped also from Fedora 2 years ago by commit https://src.fedoraproject.org/rpms/bind/c/e001c1a0663326dffac1ee7d65598550e4b2f70a?branch=master

Part of patch were already reverted, the rest will be dropped as well.

Comment 16 Petr Menšík 2017-12-06 09:52:30 UTC
Remaining part from comment #13 returned back, because it caused regression - bug #1520958. Remaining patch renamed to reflect it fixed bug #726120. In next major release support for this bug would be discontinued.

Comment 21 errata-xmlrpc 2018-04-10 11:56:55 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0742