Red Hat Bugzilla – Bug 809562
Constraints for CNAME records are not enforced
Last modified: 2015-05-20 11:35:33 EDT
This bug is created as a clone of upstream ticket: https://fedorahosted.org/freeipa/ticket/2601 Cite from http://tools.ietf.org/html/rfc1912 section 2.4: "A CNAME record is not allowed to coexist with any other data." (PTR record is an exception, see further text in RFC.) If there are multiple records for single DNS name (with CNAME and other RR types at same time), behaviour is undefined. BIND refuses to load zone with mixed names/records. We have to follow standard and enforce same constraint.
Please add steps to verify this bug
1) Add CNAME record with name "test" which points to name "blahblahblah". 2) Try to add another record with name "test" and any type other than CNAME - it should fail, because CNAME and A records are not allowed on single name. E.g. adding an A record should fail. Another disallowed combination from RFC 1912: podunk.xx. IN NS ns1 IN NS ns2 IN CNAME mary
Previous comment should say: 2) ... it should fail, because CNAME and *other* record *types* are not allowed on single name.
This request was not resolved in time for the current release. Red Hat invites you to ask your support representative to propose this request, if still desired, for consideration in the next release of Red Hat Enterprise Linux.
This request was erroneously removed from consideration in Red Hat Enterprise Linux 6.4, which is currently under development. This request will be evaluated for inclusion in Red Hat Enterprise Linux 6.4.
Fixed upstream. master: 854b7636754643291800ec9d76ab081a870415e5
regression test automated in DNS test suite
Verified using:ipa-server-3.0.0-11.el6.x86_64 test output: :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: :: [ LOG ] :: 809562 Constraints for CNAME records are not enforced :::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: kdestroy: No credentials cache found while destroying cache spawn /usr/bin/kinit -V admin Using default cache: /tmp/krb5cc_0 Using principal: admin@TESTRELM.COM Password for admin@TESTRELM.COM: Authenticated to Kerberos v5 Default principal: admin@TESTRELM.COM :: [22:10:14] :: kinit as admin with password Secret123 was successful. :: [ PASS ] :: Kinit as admin user Record name: tt A record: 1.2.3.4 :: [ PASS ] :: Add a A record to conflict with the cname record A record: 1.2.3.4 :: [ PASS ] :: Make sure the A record was created ipa: ERROR: invalid 'cnamerecord': CNAME record is not allowed to coexist with any other records except PTR :: [ PASS ] :: Attempt to add a cname record, this should fail :: [ PASS ] :: Make sure the CNAME record was not created ------------------- Deleted record "tt" ------------------- :: [ PASS ] :: Delete the A record that conflict with the cname record :: [ PASS ] :: Make sure the A record was removed Record name: tt CNAME record: tt.testrelm.com :: [ PASS ] :: Adding a cname record CNAME record: tt.testrelm.com :: [ PASS ] :: Make sure the CNAME record was created ipa: ERROR: invalid 'cnamerecord': CNAME record is not allowed to coexist with any other records except PTR :: [ PASS ] :: Attempt to create a A record to conflict with the CNAME record. :: [ PASS ] :: Make sure the A record was not created ------------------- Deleted record "tt" -------------------
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2013-0528.html