Bug 868956 - Adding dnszone using name-server and ipaddress, adds zone with incorrect data
Summary: Adding dnszone using name-server and ipaddress, adds zone with incorrect data
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: ipa
Version: 6.3
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: ---
Assignee: Rob Crittenden
QA Contact: Namita Soman
Depends On:
TreeView+ depends on / blocked
Reported: 2012-10-22 14:45 UTC by Namita Soman
Modified: 2015-01-21 15:37 UTC (History)
2 users (show)

Fixed In Version: ipa-3.0.0-8.el6
Doc Type: Bug Fix
Doc Text:
Cause: Identity Management dnszone-add command accepts --name-server option specifying a hostname of primary name server resolving the zone. However, the option considered all hostnames as fully qualified domain names (FQDN) even though they were not FQDN (e.g. nameserver "ns.example.com." for zone example.com) and were relative to the zone name (e.g. nameserver "ns" for zone "example.com"). Consequence: When using Identity Management dnszone-add command, the Administrator was not able to specify nameserver in the relative name format. Fix: Detect the nameserver format correctly with respect to DNS naming rules, i.e. name with trailing "." is FQDN, name without trailing "." is a relative name. Result: dnszone-add command can process both relative and fully qualified domain names.
Clone Of:
Last Closed: 2013-02-21 09:28:38 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2013:0528 normal SHIPPED_LIVE Low: ipa security, bug fix and enhancement update 2013-02-21 08:22:21 UTC

Description Namita Soman 2012-10-22 14:45:06 UTC
Description of problem:

Can add zone using cmd below:
# ipa dnszone-add --name-server=ipaqa64vmc.testrelm.com --admin-email=ipaqar.redhat.com --serial=2010010701 --refresh=303 --retry=101 --expire=1202 --minimum=33 --ttl=55 westford.testrelm.com

To this Petr's response:
CLI adds implicit dot to end of the name-server parameter.
That is a reason why it works in your case.

There are two rules:
  --> name has to be resolvable to IP address
      (i.e. name belongs to existing zone and is resolvable)
  --> your test case falls to this category because of implicit dot
  --> test will pass because "ipaqa64vmc.testrelm.com" is resolvable

  --> --ip-address= has to be used because hostname is not resolvable to IP
  --> relative.hostname will be expanded to relative.hostname.new.zone. - this
name can't be resolvable because that zone doesn't exist yet

So tried the below which adds the zone, but has invalid data:

# ipa dnszone-add --name-server=pspacek --ip-address=  q.test
Administrator e-mail address [hostmaster.q.test.]: 
ipa: ERROR: 'dnszoneidnsname' is required

[root@pspacek nsupdate-test]# ipa dnszone-show q.test
  Zone name: q.test
  Authoritative nameserver: pspacek.                <<<<---- that is wrong - there should not be a dot at the end of name
  Administrator e-mail address: hostmaster.q.test.
  SOA serial: 1350916014
  SOA refresh: 3600
  SOA retry: 900
  SOA expire: 1209600
  SOA minimum: 3600
  Active zone: TRUE
  Allow query: any;
  Allow transfer: none;

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Add a new zone usign relative hostname, and ipaddress
Actual results:
throws an error, adds the zone, but dnszone-show has a period at the end of the nameserver

Expected results:
add zone sucessully, with no error and dnszone-show should not have a period at the end of the nameserver.

Additional info:

Comment 1 Martin Kosek 2012-10-23 06:52:09 UTC
Upstream ticket:

Comment 2 Martin Kosek 2012-11-06 16:48:01 UTC
Fixed upstream:
master: https://fedorahosted.org/freeipa/changeset/a00109585684fac520c48188298b75df816fbd23
ipa-3-0: https://fedorahosted.org/freeipa/changeset/dc406253821ba7a616dd12e2bcc5dd602247a279

--name-server option now behaves correctly with respect to absolute/relative DNS names. You may need to update your test cases if you do not use it right!


1) Add new zone using absolute address to nameserver:

# ipa dnszone-add new.zone --name-server ns.ipa.testrelm.

Effective nameserver will be ns.ipa.testrelm.

2) Add new zone using relative address to nameserver:

# ipa dnszone-add new.zone --name-server ns --ip-address

Effective nameserver will be ns.new.zone.
New A record with IP will be created in new.zone

Comment 4 Namita Soman 2013-01-14 16:57:00 UTC
Verified using ipa-server-3.0.0-20.el6.x86_64

# ipa dnszone-add --name-server=nightcrawler --ip-address= qwe
Administrator e-mail address [hostmaster.qwe.]: 
  Zone name: qwe
  Authoritative nameserver: nightcrawler
  Administrator e-mail address: hostmaster.qwe.
  SOA serial: 1358182380
  SOA refresh: 3600
  SOA retry: 900
  SOA expire: 1209600
  SOA minimum: 3600
  BIND update policy: grant TESTRELM.COM krb5-self * A; grant TESTRELM.COM
                      krb5-self * AAAA; grant TESTRELM.COM krb5-self * SSHFP;
  Active zone: TRUE
  Dynamic update: FALSE
  Allow query: any;
  Allow transfer: none;

# ipa dnsrecord-find qwe
  Record name: @
  NS record: nightcrawler

  Record name: nightcrawler
  A record:
Number of entries returned 2

Comment 6 errata-xmlrpc 2013-02-21 09:28:38 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.