Re: BIND-DLZ cache corruption issue.

This particular issue is cannot be replicated with a flat text zone file.
 That issue was fixed with I believe the 9.5 release.  BIND now properly
throws an error when it encounters a TXT record that is longer than 255
bytes in length or is not properly closed in quotations.  So no, this issue
is not repeatable outside of DLZ.  However the zone that this issue happened
on is a DLZ based zone.  Even if I were to mix and match some zones in DLZ
and some in flat text files, if the record loads out of the DLZ and is too
long/truncated it causes the issues for every other zone being served
because the global cache is corrupt.  It's not a massive problem because
most organizations will never have an SPF record that large or they will
concatenate two from seperate zones together with a proper include (which
has other negative affects).  That being said, its pretty bad that it
effectively takes down the entire service until the issue is located and
resolved.

My suggestion/request is that if this issue can be replicated in house
(which I suspect will not be a problem considering I can cause it at will
here) that each entry be checked for validity when read and if one fails, it
rejects the record and does not load it, throwing an error to the log and
continuing normal operation.  Either that or it force truncates it and
closes off the entry with proper quotes (which I think is a bad way to go).

--M

2010/9/30 Scott Haneda <[email protected]>

> On Sep 30, 2010, at 9:43 AM, "Michael J. Ayers" <[email protected]>
> wrote:
>
> Positive.  You can probably replicate this yourself.  We are using BIND
> 6.5.1-3.P3 and 9.6.1-16-P3 here.  Add a zone for <http://example.com>
> example.com (or other) and add an MX host to it then add a TXT record for
> SPF similar to the following:
>
>
> You can mix and match with DLZ in that some zones can come out of a
> database like MySql or PGSql, and others can use the original text file
> method that most all non DB backed NS's use.
>
> I would be curious for you to replicate the zone problem to a text file
> based zone. Create the same format error with the TXT records string length
> being too long.
>
> I am guessing what will happen is named-checkzone/named-checkconf will one
> or the other report errors. rndc will probably fail a reload, and perhaps
> named will not start/restart either.
>
> I wonder what the results will be.
>
> It's a tough call on the right thing to do. Badly formatted data in named
> seems to go through a set of checks that if severe enough, named won't
> start. That seems logical.
>
> But by adding DLZ, those checks can no longer happen, since the zone is
> loaded dynamically. I think ideally I would want the entire zone to be
> skipped, and the zone skipping logged.
>
> If I remember correct, you were getting crashes or a dead/stalled server.
> If that doesn't happen with non DLZ settings, I think the DLZ side should be
> changed to behave the sane way.
>
> In the meantime, how about a simple set of checks on the server side to
> validate? You can then check strlen() and also do other nice things like
> make sure there is a trailing dot when needed, or not. Domain validation and
> checking that domain is registered, has it's NS's correctly pointing to you
> and backups etc.
>
> It seems to me, regardless of what named does with the data, it's a good
> idea to validate that data first.
> --
> Scott * If you contact me off list replace talklists@ with scott@ *
>
>
>
> ------------------------------------------------------------------------------
> Start uncovering the many advantages of virtual appliances
> and start using them to simplify application deployment and
> accelerate your shift to cloud computing.
> http://p.sf.net/sfu/novell-sfdev2dev
> _______________________________________________
> Bind-dlz-testers mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/bind-dlz-testers
>
>


-- 
Michael J. Ayers
Senior Systems Engineer

------------------------------------------------------------------------------
Start uncovering the many advantages of virtual appliances
and start using them to simplify application deployment and
accelerate your shift to cloud computing.
http://p.sf.net/sfu/novell-sfdev2dev

_______________________________________________
Bind-dlz-testers mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bind-dlz-testers