Bug 829340 - plugin doesn't handle IPv6 elements in idnsForwarders attribute
plugin doesn't handle IPv6 elements in idnsForwarders attribute
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: bind-dyndb-ldap (Show other bugs)
6.4
Unspecified Unspecified
medium Severity unspecified
: rc
: ---
Assigned To: Adam Tkac
Namita Soman
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-06-06 10:08 EDT by Martin Kosek
Modified: 2015-05-20 11:42 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: It was possible to configure only IPv4 forwarders in LDAP Consequence: IPv6 forwarders couldn't be used Fix: The plugin was patched Result: The plugin is now able to parse & use IPv6 forwarders
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-02-21 03:57:51 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Martin Kosek 2012-06-06 10:08:32 EDT
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/bind-dyndb-ldap/ticket/49

The plugin should support IPv6 forwarders.
Comment 1 RHEL Product and Program Management 2012-07-10 04:51:20 EDT
This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.
Comment 2 RHEL Product and Program Management 2012-07-10 19:06:26 EDT
This request was erroneously removed from consideration in Red Hat Enterprise Linux 6.4, which is currently under development.  This request will be evaluated for inclusion in Red Hat Enterprise Linux 6.4.
Comment 3 Jenny Galipeau 2012-07-13 10:45:47 EDT
please add steps to reproduce / verify this bug
Comment 4 Petr Spacek 2012-07-13 11:58:25 EDT
Just put IPv6 address to idnsForwarders attribute. It should work in exactly same way as with IPv4 address.
Older version (without IPv6 support) should work with IPv4 address only.
Comment 11 Michael Gregg 2013-01-22 20:21:30 EST
Verified with the following steps against ipa-server-3.0.0-9.el6.x86_64 and bind-dyndb-ldap-2.3-1.el6.x86_64

On the first server: 
[root@zippyvm11 ~]# ipa dnszone-add --name-server=$MASTER. newtzoneAdministrator e-mail address [hostmaster.newtzone.]: 
  Zone name: newtzone
  Authoritative nameserver: zippyvm11.testrelm.com.
  Administrator e-mail address: hostmaster.newtzone.
  SOA serial: 1358903541
  SOA refresh: 3600
  SOA retry: 900
  SOA expire: 1209600
  SOA minimum: 3600
  BIND update policy: grant TESTRELM.COM krb5-self * A; grant TESTRELM.COM krb5-self * AAAA; grant TESTRELM.COM krb5-self * SSHFP;
  Active zone: TRUE
  Dynamic update: FALSE
  Allow query: any;
  Allow transfer: none;

[root@zippyvm11 ~]# server2ipv6='3ffe:1111:2222:2000:230:48ff:fe8c:100'
[root@zippyvm11 ~]# ipa dnszone-mod $tzone --addattr=idnsForwarders="$server2ipv6"
  Zone name: newtzone
  Authoritative nameserver: zippyvm11.testrelm.com.
  Administrator e-mail address: hostmaster.newtzone.
  SOA serial: 1358903542
  SOA refresh: 3600
  SOA retry: 900
  SOA expire: 1209600
  SOA minimum: 3600
  Active zone: TRUE
  Allow query: any;
  Allow transfer: none;
  Zone forwarders: 3ffe:1111:2222:2000:230:48ff:fe8c:100

Now to the second server:
[root@zippyvm4 ~]# ipa dnszone-add --name-server=$MASTER. newtzone
Administrator e-mail address [hostmaster.newtzone.]: 
  Zone name: newtzone
  Authoritative nameserver: zippyvm4.testrelm.com.
  Administrator e-mail address: hostmaster.newtzone.
  SOA serial: 1358903658
  SOA refresh: 3600
  SOA retry: 900
  SOA expire: 1209600
  SOA minimum: 3600
  BIND update policy: grant TESTRELM.COM krb5-self * A; grant TESTRELM.COM krb5-self * AAAA; grant TESTRELM.COM
                      krb5-self * SSHFP;
  Active zone: TRUE
  Dynamic update: FALSE
  Allow query: any;
  Allow transfer: none;

[root@zippyvm4 ~]# ipa dnsrecord-add $tzone aaaatest --aaaa-rec='3ffe:1111:2222:2000:230:48ff:fe8c:100'
  Record name: aaaatest
  AAAA record: 3ffe:1111:2222:2000:230:48ff:fe8c:100

[root@zippyvm4 ~]# dig aaaatest.$tzone aaaa @127.0.0.1
; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.16.rc1.el6 <<>> aaaatest.newtzone aaaa @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26068
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1
;; QUESTION SECTION:
;aaaatest.newtzone.		IN	AAAA
;; ANSWER SECTION:
aaaatest.newtzone.	86400	IN	AAAA	3ffe:1111:2222:2000:230:48ff:fe8c:100
;; AUTHORITY SECTION:
newtzone.		86400	IN	NS	zippyvm4.testrelm.com.
;; ADDITIONAL SECTION:
zippyvm4.testrelm.com.	1200	IN	A	10.14.5.136
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Jan 22 20:16:53 2013
;; MSG SIZE  rcvd: 114

Back to the first server:
[root@zippyvm11 ~]# dig aaaatest.$tzone aaaa @127.0.0.1

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.16.rc1.el6 <<>> aaaatest.newtzone aaaa @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56218
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;aaaatest.newtzone.		IN	AAAA

;; ANSWER SECTION:
aaaatest.newtzone.	86400	IN	AAAA	3ffe:1111:2222:2000:230:48ff:fe8c:100

;; AUTHORITY SECTION:
newtzone.		86400	IN	NS	zippyvm4.testrelm.com.

;; ADDITIONAL SECTION:
zippyvm4.testrelm.com.	1200	IN	A	10.14.5.136

;; Query time: 15 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Jan 22 20:17:04 2013
;; MSG SIZE  rcvd: 114



Forward works through the AAAA forwarder.
Comment 12 Petr Spacek 2013-01-23 03:37:16 EST
Could you please replace syntax
# ipa dnszone-mod $tzone --addattr=idnsForwarders="$server2ipv6"
with
# ipa dnszone-mod $tzone --forwarder="$server2ipv6"
?

I'm not sure if --addattr is supported. Anyway, addattr it is not the recommended way :-)

Thank you.
Comment 13 Michael Gregg 2013-01-23 14:01:28 EST
That is correct that using addattr is not the recommended way, but it is working, and using that value is part of the ticket description. 

I can reverify this bug using the dnszone-mod --forwarder method if you would like.
Comment 14 Michael Gregg 2013-01-23 19:00:35 EST
reverified using ipa dnszone-mod $tzone --forwarder="$server2ipv6"


[root@zippyvm11 ~]# ipa dnszone-add --name-server=$MASTER. newtzone
Administrator e-mail address [hostmaster.newtzone.]: 
  Zone name: newtzone
  Authoritative nameserver: zippyvm11.testrelm.com.
  Administrator e-mail address: hostmaster.newtzone.
  SOA serial: 1358985423
  SOA refresh: 3600
  SOA retry: 900
  SOA expire: 1209600
  SOA minimum: 3600
  BIND update policy: grant TESTRELM.COM krb5-self * A; grant TESTRELM.COM krb5-self * AAAA; grant TESTRELM.COM krb5-self * SSHFP;
  Active zone: TRUE
  Dynamic update: FALSE
  Allow query: any;
  Allow transfer: none;
[root@zippyvm11 ~]# server2ipv6='3ffe:1111:2222:2000:230:48ff:fe8c:100'
[root@zippyvm11 ~]# ipa dnszone-mod $tzone --forwarder="$server2ipv6"
  Zone name: newtzone
  Authoritative nameserver: zippyvm11.testrelm.com.
  Administrator e-mail address: hostmaster.newtzone.
  SOA serial: 1358985424
  SOA refresh: 3600
  SOA retry: 900
  SOA expire: 1209600
  SOA minimum: 3600
  Active zone: TRUE
  Allow query: any;
  Allow transfer: none;
  Zone forwarders: 3ffe:1111:2222:2000:230:48ff:fe8c:100
[root@zippyvm11 ~]# 

[root@zippyvm4 ~]# ipa dnszone-add --name-server=$MASTER. newtzone
Administrator e-mail address [hostmaster.newtzone.]: 
  Zone name: newtzone
  Authoritative nameserver: zippyvm4.testrelm.com.
  Administrator e-mail address: hostmaster.newtzone.
  SOA serial: 1358985519
  SOA refresh: 3600
  SOA retry: 900
  SOA expire: 1209600
  SOA minimum: 3600
  BIND update policy: grant TESTRELM.COM krb5-self * A; grant TESTRELM.COM krb5-self * AAAA; grant TESTRELM.COM
                      krb5-self * SSHFP;
  Active zone: TRUE
  Dynamic update: FALSE
  Allow query: any;
  Allow transfer: none;
[root@zippyvm4 ~]# ipa dnsrecord-add $tzone aaaatest --aaaa-rec='3ffe:1111:2222:2000:230:48ff:fe8c:100'
  Record name: aaaatest
  AAAA record: 3ffe:1111:2222:2000:230:48ff:fe8c:100
[root@zippyvm4 ~]# dig aaaatest.$tzone aaaa @127.0.0.1

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.16.rc1.el6 <<>> aaaatest.newtzone aaaa @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54157
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;aaaatest.newtzone.		IN	AAAA

;; ANSWER SECTION:
aaaatest.newtzone.	86400	IN	AAAA	3ffe:1111:2222:2000:230:48ff:fe8c:100

;; AUTHORITY SECTION:
newtzone.		86400	IN	NS	zippyvm4.testrelm.com.

;; ADDITIONAL SECTION:
zippyvm4.testrelm.com.	1200	IN	A	10.14.5.136

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Wed Jan 23 18:59:12 2013
;; MSG SIZE  rcvd: 114


[root@zippyvm11 ~]# dig aaaatest.$tzone aaaa @127.0.0.1

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.16.rc1.el6 <<>> aaaatest.newtzone aaaa @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39253
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;aaaatest.newtzone.		IN	AAAA

;; ANSWER SECTION:
aaaatest.newtzone.	86400	IN	AAAA	3ffe:1111:2222:2000:230:48ff:fe8c:100

;; AUTHORITY SECTION:
newtzone.		86400	IN	NS	zippyvm4.testrelm.com.

;; ADDITIONAL SECTION:
zippyvm4.testrelm.com.	1200	IN	A	10.14.5.136

;; Query time: 4 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Wed Jan 23 18:59:55 2013
;; MSG SIZE  rcvd: 114


forwarding with a IPV6 address works.
Comment 15 Petr Spacek 2013-01-24 04:58:39 EST
Perfect, thank you!
Comment 17 errata-xmlrpc 2013-02-21 03:57:51 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-0359.html

Note You need to log in before you can comment on or make changes to this bug.