Bug 1283943 - IPA DNS Zone/DNS Forward Zone details missing after upgrade from RHEL 7.0 to RHEL 7.2
IPA DNS Zone/DNS Forward Zone details missing after upgrade from RHEL 7.0 to ...
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa (Show other bugs)
7.2
All Linux
urgent Severity urgent
: rc
: ---
Assigned To: Martin Bašti
Namita Soman
: Regression, ZStream
Depends On:
Blocks: 1284052
  Show dependency treegraph
 
Reported: 2015-11-20 06:12 EST by Nikhil Dehadrai
Modified: 2016-11-04 01:41 EDT (History)
9 users (show)

See Also:
Fixed In Version: ipa-4.2.0-16.el7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1284052 (view as bug list)
Environment:
Last Closed: 2016-11-04 01:41:03 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Nikhil Dehadrai 2015-11-20 06:12:59 EST
Description of problem:
IPA DNS Zone/DNS Forward Zone details missing after upgrade from RHEL 7.0 to RHEL 7.2

Version-Release number of selected component (if applicable):
ipa-server-dns-4.2.0-15.el7.x86_64
Red Hat Enterprise Linux Server release 7.2 (Maipo)

How reproducible: Always


Steps to Reproduce:
1. Setup RHEL7.0 host with IPA master
2. Add DNS ZONE, DNS Zone forwarder using ipa dnszone-add.
3. Also create similar entries through UI. 
4. Add RHEl7.2 repos and run yum update
5. Verify the Server UI for created DNS zone, DNS ZONE forwarder entries.
6. Verify the same details using commandline 
#ipa dnsforwardzone-show 
#ipa dnszone-show

Actual results:
1. After step5, the DNS ZONE, DNS Zone forwarder entries created before upgrade to RHEL 7.2 are not displayed at the server UI.
2. After step6, DNS Zone and DNS Zone forwarder entries are not returned.
ipa: ERROR: example.com.: DNS zone not found
ipa: ERROR: abcd.com.: DNS forward zone not found

Expected results:
DNS Zone and DNS Zone forwarder entries should be visible after the upgrade using their respective commands.
#ipa dnsforwardzone-show 
#ipa dnszone-show

Additional info:
1. respectivie ldif file containing DNS zone details is present under /var/lib/ipa/backup.
 
2. Following error message was displayed at /var/log/messages

DNS ZONE:
-------------
[root@bender yum.repos.d]# cat /var/log/messages | grep example
Nov 20 01:23:30 bender named[14565]: zone example.com/IN: NS 'example.com.example.com' has no address records (A or AAAA)
Nov 20 01:23:30 bender named[14565]: zone example.com/IN: not loaded due to errors.
Nov 20 01:23:30 bender named[14565]: update_zone (psearch) failed for 'idnsname=example.com,cn=dns,dc=testrelm,dc=test'. Zones can be outdated, run `rndc reload`: bad zone
Nov 20 01:23:30 bender named[14565]: SOA serial number incrementation failed in zone 'idnsname=example.com,cn=dns,dc=testrelm,dc=test': zone not loaded
Nov 20 01:23:30 bender named[14565]: zone example.com/IN: reloaded serial 1448000610
Nov 20 01:23:30 bender named[14565]: zone example.com/IN: sending notifies (serial 1448000610)
Nov 20 01:23:35 bender named[14565]: zone example.com/IN: sending notifies (serial 1448000612)
Nov 20 01:53:44 bender named[14565]: zone example.com/IN: shutting down
Nov 20 02:44:03 bender named[14565]: update_record (psearch) failed, dn 'idnsname=example.com,idnsname=example.com,cn=dns,dc=testrelm,dc=test' change type 0x0. Records can be outdated, run `rndc reload`: not found
Nov 20 02:44:03 bender named[14565]: update_record (psearch) failed, dn 'idnsname=_kerberos,idnsname=example.com,cn=dns,dc=testrelm,dc=test' change type 0x0. Records can be outdated, run `rndc reload`: not found

DNS Forward ZONE:
--------------------
[root@bender backup]# cat /var/log/messages | grep abcd
Nov 20 01:57:27 bender named[14565]: zone abcd.com/IN: NS 'abcd.com.abcd.com' has no address records (A or AAAA)
Nov 20 01:57:27 bender named[14565]: zone abcd.com/IN: not loaded due to errors.
Nov 20 01:57:27 bender named[14565]: update_zone (psearch) failed for 'idnsname=abcd.com.,cn=dns,dc=testrelm,dc=test'. Zones can be outdated, run `rndc reload`: bad zone
Nov 20 01:57:27 bender named[14565]: SOA serial number incrementation failed in zone 'idnsname=abcd.com.,cn=dns,dc=testrelm,dc=test': zone not loaded
Nov 20 01:57:27 bender named[14565]: zone abcd.com/IN: reloaded serial 1448002642
Nov 20 01:57:27 bender named[14565]: zone abcd.com/IN: sending notifies (serial 1448002642)
Nov 20 01:57:32 bender named[14565]: zone abcd.com/IN: sending notifies (serial 1448002648)
Nov 20 01:57:47 bender named[14565]: zone abcd.com/IN: sending notifies (serial 1448002667)
Nov 20 01:57:47 bender named[14565]: LDAP error: No such object: Range Check error: while modifying(replace) entry 'idnsname=abcd.com.,cn=dns,dc=testrelm,dc=test'
Nov 20 01:57:47 bender named[14565]: SOA serial number incrementation failed in zone 'idnsname=abcd.com.,cn=dns,dc=testrelm,dc=test': failure
Nov 20 01:57:47 bender named[14565]: update_record (psearch) failed, dn 'idnsname=_kerberos,idnsname=abcd.com.,cn=dns,dc=testrelm,dc=test' change type 0x2. Records can be outdated, run `rndc reload`: failure
Nov 20 01:57:47 bender named[14565]: zone abcd.com/IN: shutting down
Nov 20 01:58:37 bender named[14565]: update_record (psearch) failed, dn 'idnsname=abcd.com,idnsname=abcd.com.,cn=dns,dc=testrelm,dc=test' change type 0x1. Records can be outdated, run `rndc reload`: not found
Nov 20 01:59:53 bender named[14565]: zone abcd.com/IN: loaded serial 1448002717
Nov 20 01:59:53 bender named[14565]: zone abcd.com/IN: sending notifies (serial 1448002793)
Nov 20 01:59:58 bender named[14565]: zone abcd.com/IN: sending notifies (serial 1448002793)
Nov 20 02:05:05 bender named[14565]: zone abcd.com/IN: shutting down
Nov 20 02:44:03 bender named[14565]: update_record (psearch) failed, dn 'idnsname=abcd.com,idnsname=abcd.com.,cn=dns,dc=testrelm,dc=test' change type 0x0. Records can be outdated, run `rndc reload`: not found
[root@bender backup]#
Comment 1 Martin Bašti 2015-11-20 06:16:22 EST
Upstream ticket:
https://fedorahosted.org/freeipa/ticket/5472
Comment 3 Martin Bašti 2015-11-20 06:35:56 EST
Original dns forward zones has to be migrated to new forward zones during upgrade. Otherwise the forward zones will not work as expected with bind-dyndb-ldap.

Fail during upgrade causes that the original forward zones were removed (it has to be in every case) but due to bug in dnszone-del code, removal has not been finished properly, thus no new forward zones have been recreated.

Impact: forward zones will be removed which may break a customer configuration.
This happen only with RHEL 7.0 -> 7.2 upgrade, this migration upgrade is not executed during 7.1 -> 7.2 upgrade.

Workaround: Unknown, forward zones must be added back to IPA manually

Upgrade did backup of original DNS zone data which has to be migrated to IPA as forwardzones.
Comment 13 Nikhil Dehadrai 2016-08-09 08:15:28 EDT
IPA server version: ipa-server-4.4.0-5.el7.x86_64

Tested the bug on the basis of following steps:
1. Noticed that IPA DNS Zone/DNS Forward Zone details are not found after upgrade from 7.0 to 7.3.
2. See below for console output logs.

[root@vm-idm-004 ~]# ipa dnszone-find
ipa: ERROR: 2.114 client incompatible with 2.65 server at 'https://<ipa-server-hostname>/ipa/xml'

[root@vm-idm-004 ~]# kinit admin
Password for admin@TESTRELM.TEST: 

[root@vm-idm-004 ~]# ipa dnszone-find
ipa: ERROR: 2.114 client incompatible with 2.65 server at 'https://<ipa-server-hostname>/ipa/xml'
[root@vm-idm-004 ~]# ipa dnsforwardzone-find
ipa: ERROR: unknown command 'dnsforwardzone_find'

[root@vm-idm-004 ~]# rpm -q ipa-server
ipa-server-4.4.0-5.el7.x86_64

Thus on the basis of above observations marking the status of bugs to "ASSIGNED"
Comment 14 Petr Spacek 2016-08-09 08:56:05 EDT
Honza, could you tell us what is the probable cause of problem mentioned in comment #13?

I'm quite sure that it is not related to DNS :-)
Comment 15 Petr Vobornik 2016-08-09 13:09:01 EDT
Same error was seen also in bug 1365507. I suspect same cause, probably missing restart of httpd service in the upgrade.
Comment 16 Jan Cholasta 2016-08-18 03:04:55 EDT
Yes, that seems to be the cause.
Comment 17 Petr Vobornik 2016-09-05 10:48:07 EDT
moving back to on QA as the issue in comment 13 should be fixed in bug 1365572
Comment 18 Nikhil Dehadrai 2016-09-13 02:18:26 EDT
IPA server version: ipa-server-4.4.0-10.el7.x86_64

Verified that after updating ipa server hosted on RHEL 7.0 to RHEL 7.3, then 'ipa dnszone-find' and 'ipa dnsforwardzone-find' coomands are successfully run and error mention above in comment#13 is not observed.

Thus marking the status of bug to "VERIFIED".
Comment 21 errata-xmlrpc 2016-11-04 01:41:03 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2404.html

Note You need to log in before you can comment on or make changes to this bug.