Re: problem with zone delegation

Update your authority query to only return results where host = '@'.

select ttl, type, data, resp_person, serial, refresh, retry, expire, minimum
         from dns_records where zone = '%zone%' and (type = 'SOA' or type='NS') 
        and host ='@'

I believe you also need the IP's for ns1.external.com & ns2.external.com in your example.com zone for delegation to work.  Otherwise you get into a catch-22 where the resolver knows the name of the external.com name servers, but not the IP so it can't get to the name servers.

Rob

----- Original Message ----
From: Igor Serebryany <[email protected]>
To: [email protected]
Sent: Thursday, May 22, 2008 6:28:02 PM
Subject: [Bind-dlz-testers] problem with zone delegation


hi,

    i think i may have discovered a bug in bind-dlz.  I am attempting to
    delegate a zone to outside nameservers.  my mysql database has data
    that looks like this (irrelevant fields omited):
host    type    data                zone
@        ns        ns1.myserver.com.    example.com
@        ns        ns2.myserver.com.    example.com
sub        ns        ns1.external.com.    example.com
sub        ns        ns2.external.com.    example.com

    What i am not hosting any other records for sub.example.com, however
    n1 and ns2.external.com have the complete zone.

    this is the appropriate way to delegate zones in bind.  however,
    this does not work with dlz.  i think this is because, for the
    authority query, no host is returned.  when i dig the authority
    section for example.com from the dlz server, i get all 4 nameservers
    listed like this:

;; AUTHORITY SECTION:
example.com.    600        IN    NS    ns1.myserver.com.
example.com.    600        IN    NS    ns2.myserver.com.
example.com.    600        IN    NS    ns1.external.com.
example.com.    600        IN    NS    ns2.external.com.

    where i would expect to see only the two nameservers for the host @
    and not any of the servers for the host 'sub'.

    This causes other problems as well.  for instance, suppose i have NS
    records for both @ and sub with different TTL values.  because
    they're both returned in one result, i get the bind error 'bad TTL'
    since bind expects all RRSETs to have the same TTL.  but the
    nameservers for sub are not part of the RRSET for @!

    this is a pretty major problem. i had to move the zone for an
    affected (major) client back to a bind file to fix the delegation
    issue, so this is pretty much a showstopper for DLZ.  Any
    workarounds would be appreciated.

    Here is my named.conf file and db scheme, just in case:

dlz "Mysql zone" {
    database "mysql
    {host=localhost dbname=mydb user=bind pass=mypass socket=/var/lib/mysql/mysql.sock}
    {select zone from dns_records where zone = '%zone%'}
    {select ttl, type, mx_priority, data from dns_records where zone = '%zone%' and host = '%record%'
         and not (type = 'SOA' or type = 'NS')}
    {select ttl, type, data, resp_person, serial, refresh, retry, expire, minimum
         from dns_records where zone = '%zone%' and (type = 'SOA' or type='NS')}
    {}
    {}
    {}";
};

mysql> describe dns_records;
+-------------+------------------------------------------------------------+------+-----+---------+----------------+
| Field       | Type                                                       | Null | Key | Default | Extra          |
+-------------+------------------------------------------------------------+------+-----+---------+----------------+
| id          | int(10) unsigned                                           | NO   | PRI | NULL    | auto_increment |
| zone        | text                                                       | NO   | MUL | NULL    |                |
| host        | text                                                       | YES  |     | NULL    |                |
| type        | enum('AAAA','PTR','SOA','NS','MX','A','CNAME','TXT','KEY') | NO   |     | NULL    |                |
| data        | varchar(256)                                               | YES  |     | NULL    |                |
| ttl         | int(11)                                                    | NO   |     | 86400   |                |
| mx_priority | text                                                       | YES  |     | NULL    |                |
| refresh     | int(11)                                                    | YES  |     | NULL    |                |
| retry       | int(11)                                                    | YES  |     | NULL    |                |
| expire      | int(11)                                                    | YES  |     | NULL    |                |
| minimum     | int(11)                                                    | YES  |     | NULL    |                |
| serial      | bigint(20)                                                 | YES  |     | NULL    |                |
| resp_person | text                                                       | YES  |     | NULL    |                |
| uberid      | int(11)                                                    | NO   | MUL | NULL    |                |
+-------------+------------------------------------------------------------+------+-----+---------+----------------+
14 rows in set (0.00 sec)

Thanks!

--Igor

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Bind-dlz-testers mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bind-dlz-testers



      

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/