Bug#406411: Fwd (debian bug): bind/named SERVFAIL != Query form disallowed client

Hi!

Here's a bug report with patch for service/named, but I'm not sure if
it's right. Can anyone look at it, please?

Please keep the bug CCed.

Willi

> Package: logwatch
> Version: 7.3.1-5
> Severity: normal
> 
> SERVFAIL is a normal part of this computer (due to incomming spam I
> think), it should not be classified as "Query form disallowed client":
> 
>   Query form disallowed client: 
>     unexpected RCODE (SERVFAIL) resolving '207.252.117.75.in-addr.arpa/PTR/IN': 203.8.183.1#53: 1 Time(s) 
>     unexpected RCODE (SERVFAIL) resolving '129.31.52.211.in-addr.arpa/PTR/IN': 202.173.159.5#53: 1 Time(s) 
>     unexpected RCODE (SERVFAIL) resolving 'MN2-CT-u-0465.mc.onolab.com/A/IN': 62.42.63.51#53: 1 Time(s) 
>     unexpected RCODE (SERVFAIL) resolving '178.145.132.217.in-addr.arpa/PTR/IN': 203.8.183.1#53: 1 Time(s) 
> [...]
> 
> In fact, these messages should probably just be ignored.
> 
> The regexp catches all errors:
> 
>    } elsif ( ($ThisLine =~ /unexpected RCODE ([^ ]+) resolving '[^ ]+': [0-9.#]+/) ){
> 
> I changed this to:
> 
>    } elsif ( ($ThisLine =~ /unexpected RCODE \(REFUSED\) resolving '[^ ]+': [0-9.#]+/) ){
>       chomp($ThisLine);
>       $DisallClient{$ThisLine}++;
>    } elsif ( ($ThisLine =~ /unexpected RCODE ([^ ]+) resolving '[^ ]+': [0-9.#]+/) ){
> 
> (note: not sure if the unquoted brackets is a bug, they appear to be redundant..)
> 
> (ps. I suspect "form" is a typo of "from")
> 
> -- System Information:
> Debian Release: 4.0
>   APT prefers testing
>   APT policy: (500, 'testing'), (200, 'unstable')
> Architecture: i386 (i686)
> Shell:  /bin/sh linked to /bin/bash
> Kernel: Linux 2.6.18-3-xen-686
> Locale: LANG=en_AU.UTF-8, LC_CTYPE=en_AU.UTF-8 (charmap=UTF-8)
> 
> Versions of packages logwatch depends on:
> ii  exim4-daemon-light [mail-tran 4.63-12    lightweight exim MTA (v4) daemon
> ii  perl                          5.8.8-7    Larry Wall's Practical Extraction 
> 
> Versions of packages logwatch recommends:
> ii  libdate-manip-perl            5.44-5     a perl library for manipulating da
> 
> -- no debconf information
> 
>