Bug 1672788

Summary:	PowerDNS 4.0.6-2 does not pass all tests on dnsflagday.net for handling edns
Product:	[Fedora] Fedora EPEL	Reporter:	Nathan Coulson <nathan>
Component:	pdns	Assignee:	Morten Stevens <ms>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	epel7	CC:	ms, nathan, ruben, sander
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	pdns-4.1.6-1.el7	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-02-25 02:31:46 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Nathan Coulson 2019-02-05 22:12:00 UTC

Description of problem:

(Based upon the information at https://dnsflagday.net/), There are numerous DNS Vendors that will be removing workarounds for bad responses to EDNS queries.

From https://www.isc.org/blogs/dns-flag-day/, it advises "On the authoritative side, PowerDNS 4.1 is fully compliant; 4.0 has some corner cases that ednscomp notices but that are not a problem in practice – disabling caching removes those edge cases." 

Specifically, using the test utility on dnsflagday.net, it reports the following:

EDNS - Unknown Version Handling (edns1)
dig +nocookie +norec +noad +edns=1 +noednsneg soa zone @server
expect: BADVERS
expect: OPT record with version set to 0
expect: not to see SOA
See RFC6891, 6.1.3. OPT Record TTL Field Use

EDNS - Unknown Version with Unknown Option Handling (edns1opt)
dig +nocookie +norec +noad +edns=1 +noednsneg +ednsopt=100 soa zone @server
expect: BADVERS
expect: OPT record with version set to 0
expect: not to see SOA
expect: that the option will not be present in response
See RFC6891


Version-Release number of selected component (if applicable):

4.0.6-2.el7

How reproducible:

Always

Steps to Reproduce:
1. Install pdns, with a public facing IP Address
2. Use that IP Address as the nameserver for a domain
3. Test against dnsflagday.net

Actual results:

EDNS - Unknown Version Handling (edns1)
dig +nocookie +norec +noad +edns=1 +noednsneg soa mboxlogin.com @ns1.nameserverns.com
expect: BADVERS
expect: OPT record with version set to 0
expect: not to see SOA
See RFC6891, 6.1.3. OPT Record TTL Field Use

EDNS - Unknown Version with Unknown Option Handling (edns1opt)
dig +nocookie +norec +noad +edns=1 +noednsneg +ednsopt=100 soa mboxlogin.com @ns1.nameserverns.com
expect: BADVERS
expect: OPT record with version set to 0
expect: not to see SOA
expect: that the option will not be present in response
See RFC6891

Expected results:

That the check on https://dnsflagday.net/ does not result in the above 2 errors.

Additional info:

https://www.isc.org/blogs/dns-flag-day/ is claiming that pdns 4.0.x (what is in EPEL 7) has edge cases, but pdns 4.1.x should be fully compliant with what is expected for EDNS handling.

Comment 1 Fedora Update System 2019-02-07 18:57:54 UTC

pdns-4.1.6-1.el7 has been submitted as an update to Fedora EPEL 7. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-bcf7340f15

Comment 2 Fedora Update System 2019-02-10 02:12:49 UTC

pdns-4.1.6-1.el7 has been pushed to the Fedora EPEL 7 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-bcf7340f15

Comment 3 Fedora Update System 2019-02-25 02:31:46 UTC

pdns-4.1.6-1.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.