Re: Delegate NS for subdomain

I had composed a long email of things to try, then it suddenly became
obvious what was wrong.  However, I left the whole thought process in
order to illustrate how the docs and a little thinking led me to what
the problem was.  The answer is at the end of the email.

On Mon, Jan 26, 2009 at 2:31 PM, Николай <[email protected]> wrote:
> Здравствуйте, Todd.
>
> Вы писали 26 января 2009 г., 6:09:24:
>
> TL> On Fri, Jan 23, 2009 at 5:34 AM, Николай Шуляковский
> TL> <[email protected]> wrote:
> TL> <snip>
>>> And not correct answer from NS server:
>>> dig NS gorodok32.ru @ns3.agava.net.ru
>>>
>>> ; <<>> DiG 9.4.2-P2 <<>> NS gorodok32.ru @ns3.agava.net.ru
>>> ;; global options:  printcmd
>>> ;; Got answer:
>>> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62459
>>> ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0
>>>
>>> ;; QUESTION SECTION:
>>> ;gorodok32.ru.            IN    NS
>>>
>>> ;; ANSWER SECTION:
>>> gorodok32.ru.        7200    IN    NS    ns2.mamba.ru.
>>> gorodok32.ru.        7200    IN    NS    ns1.agava.net.ru.
>>> gorodok32.ru.        7200    IN    NS    ns1.mamba.ru.
>>> gorodok32.ru.        7200    IN    NS    ns2.agava.net.ru.
>
> TL> This tells me that there is something wrong with the query that bind
> TL> dlz is building.  Show your DLZ config.
>
> Where bug?

Because you asked for gorodok32.ru and you got answers back for
gorodok32.ru *and* love.gorodok32.ru.  The two NS records with
mamba.ru in it are *supposed* to be for love.gorodok32.ru, so your
query must be incorrect because it's grabbing rows for 'love' AND '@'
when it should only be returning rows for '@'.

> TL> As a test, I delegated a DNS sub-zone on my test DNS server.  It
> TL> attempted to recurse to the nameserver I had delegated it to.  I am
> TL> _relatively_ sure that it will work properly, though I've never had to
> TL> need to use it in production.  Again, if we can see your query (we've
> TL> already seen your data), maybe we can find why it's returning the data
> TL> in the wrong places.
>
> My config:
> dlz "Mysql zone" {
>        database "mysql
>                {host=***** dbname=***** user=***** pass=*****}
>                {SELECT rec.zone FROM rec WHERE rec.zone = '%zone%' limit 1}
>                {SELECT ttl, type, priority, IF(type = 'TXT', CONCAT('\"',data,'\"'), data) AS data FROM rec WHERE rec.zone = '%zone%' AND rec.host = '%record%' AND type <> 'SOA' AND type <> 'NS'}
>                {SELECT ttl, type, data, ns, contact, serial, refresh, retry, expire, minimum FROM rec WHERE rec.zone = '%zone%' AND (type = 'SOA' OR type='NS') order by type='SOA' desc}
>                {SELECT ttl, type, host, priority, IF(type = 'TXT', CONCAT('\"',data,'\"'), data) AS data, ns, contact, serial, refresh, retry, expire, minimum FROM rec WHERE rec.zone = '%zone%'}
>                {SELECT xfr.zone from xfr where xfr.client = '%client%' and '%zone%' like xfr.zone order by zone = xfr.zone desc limit 1}
>                {insert into counting set count=1,zone='%zone%' on duplicate key update count=count+1}
>        ";
> };

You do yours vastly different than mine (both table layout and number
of queries).  My setup uses just two SELECT statements to get
everything that I need.I don't have the experience with the split
lookup() and authority() queries, but basically you return SOA and NS
records with one or the other, but not both.  I return them in the
lookup() query on my, and you return them in your authority() query.
That's correct configuration.

Do the actual queries that your bind server is doing.  If you don't
know what they are, turn on query logging in mysql.  I suspect they
will be:
lookup():
SELECT ttl, type, priority, IF(type = 'TXT', CONCAT('\"',data,'\"'),
data) AS data FROM rec WHERE rec.zone = 'gorodok32.ru.' AND rec.host =
'@' AND type <> 'SOA' AND type <> 'NS';

authority():
SELECT ttl, type, data, ns, contact, serial, refresh, retry, expire,
minimum FROM rec WHERE rec.zone = 'gorodok32.ru' AND (type = 'SOA' OR
type='NS') order by type='SOA' desc;

Answer:
Hmmmmmm, now that I look at it, it's kind of obvious.  It's not your
query that's the problem, it's your data.  The lookup() query will not
return any rows for NS and SOA.  The authority() query returns _4_
rows because the only thing that it looks at is the zone, not the host
record.  The only way for you to fix this is for you to put the actual
child zone name in the zone field for the two dns zones you wish to
delegate.  Change:

| 78882 | gorodok32.ru | 7200 | NS   | love |     NULL | ns1.mamba.ru.
           | NULL              | NULL           |       NULL |    NULL
|  NULL |    NULL |    NULL |
| 78883 | gorodok32.ru | 7200 | NS   | love |     NULL | ns2.mamba.ru.
           | NULL              | NULL           |       NULL |    NULL
|  NULL |    NULL |    NULL |

to:
| 78882 | love.gorodok32.ru | 7200 | NS   | @ |     NULL |
ns1.mamba.ru.            | NULL              | NULL           |
NULL |    NULL |  NULL |    NULL |    NULL |
| 78883 | love.gorodok32.ru | 7200 | NS   | @ |     NULL |
ns2.mamba.ru.            | NULL              | NULL           |
NULL |    NULL |  NULL |    NULL |    NULL |

Sorry about the crappy line wrapping, gmail doesn't let me change
that.  I miss using mutt... :-(
-- 
Regards...      Todd
All truth passes through three stages. First, it is ridiculed. Second,
it is violently opposed. Third, it is accepted as being self-evident.

------------------------------------------------------------------------------
This SF.net email is sponsored by:
SourcForge Community
SourceForge wants to tell your story.
http://p.sf.net/sfu/sf-spreadtheword
_______________________________________________
Bind-dlz-testers mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bind-dlz-testers