gmane.network.dns.bind9.dlz

Re: DLZ LDAP users, help with testing?

Evan Hunt — 2013-03-05T02:47:44

This turned out to be the clue I needed, and I thank you. (It wasn't
enough to make things start working by itself, but it made the behavior
change and the error messages got easier to address.) 

Testing the module now. Thanks again,

Re: DLZ LDAP users, help with testing?

Dave Whitla — 2013-03-05T01:31:37

Just noticed something, possibly due to you having followed an out of date tutorial.
In your slapd.conf file change:

database      bdb

to:

database      hdb

You are trying to use the Berkeley DB backend without first loading the module I think.
The HDB module is built-in and the better default anyway.

Dave

=On 05/03/2013, at 11:06 AM, Evan Hunt <each< at >isc.org<mailto:each< at >isc.org>> wrote:

On Tue, Mar 05, 2013 at 10:20:24AM +1000, Dave Whitla wrote:
Looks like you are trying to add a record for which the DN isn't a
subordinate of the base DN.  A single OpenLDAP instance can serve
multiple base DNs. Typically though you will have only one, created when
you set up the instance.  What is your base DN?

It's "o=bind-dlz", if I understand correctly.  The configuration, such
as it is, came from the the sample data at bind-dlz.sourceforge.net<http://bind-dlz.sourceforge.net>, plus
a couple of howto documents that turned up on google.  The files
dlz.schema, slapd.conf, and example.ldif are all attached.
Thanks f

Re: DLZ LDAP users, help with testing?

Evan Hunt — 2013-03-05T01:06:36

It's "o=bind-dlz", if I understand correctly.  The configuration, such
as it is, came from the the sample data at bind-dlz.sourceforge.net, plus
a couple of howto documents that turned up on google.  The files
dlz.schema, slapd.conf, and example.ldif are all attached.
Thanks for your help!

--
Evan Hunt -- each< at >isc.org
Internet Systems Consortium, Inc.
#
#
# 1.3.6.1.4.1.18420.1.1.X is reserved for attribute types declared by the DLZ project.
# 1.3.6.1.4.1.18420.1.2.X is reserved for object classes declared by the DLZ project.
# 1.3.6.1.4.1.18420.1.3.X is reserved for PRIVATE extensions to the DLZ attribute
#                     types and object classes that may be needed by end users
#                     to add security, etc.  Attributes and object classes using
#                     this OID MUST NOT be published outside of an organization
#                     except to offer them for consideration to become part of the
#                     standard attributes and object classes published by the DLZ pro

Re: DLZ LDAP users, help with testing?

Dave Whitla — 2013-03-05T00:20:24

Hi Evan,

Looks like you are trying to add a record for which the DN isn't a subordinate of the base DN.
A single OpenLDAP instance can serve multiple base DNs. Typically though you will have only one, created when you set up the instance.
What is your base DN?


On 05/03/2013, at 5:48 AM, Evan Hunt <each< at >isc.org<mailto:each< at >isc.org>> wrote:

Salutations,

I entertained myself over the weekend by doing a port of the DLZ LDAP
driver to work as a dlopen-able DLZ module, because I am entertained by
unusual things. Having gotten it to build, however, I now find that my
lack of experience with LDAP is hindering my testing.

Has anyone out there gotten DLZ LDAP working with OpenLDAP on linux,
who could walk me through the setup process?  I have ldapadd telling me:

       adding new entry "o=bind-dlz"
       ldap_add: Server is unwilling to perform (53)
               additional info: no global superior knowledge

...and my guess is this would be easy to fix if I had a clue, but
alas, I do not.  Help?

Thanks!

--

DLZ LDAP users, help with testing?

Evan Hunt — 2013-03-04T19:48:41

Salutations,

I entertained myself over the weekend by doing a port of the DLZ LDAP
driver to work as a dlopen-able DLZ module, because I am entertained by
unusual things. Having gotten it to build, however, I now find that my
lack of experience with LDAP is hindering my testing. 

Has anyone out there gotten DLZ LDAP working with OpenLDAP on linux,
who could walk me through the setup process?  I have ldapadd telling me:

        adding new entry "o=bind-dlz"
        ldap_add: Server is unwilling to perform (53)
                additional info: no global superior knowledge

...and my guess is this would be easy to fix if I had a clue, but
alas, I do not.  Help?

Thanks!

Non-authoritative answer

Danilo — 2013-02-26T13:56:49

Hello,
I have a trouble with bind9 dlz. I had configure a bind9 (version 9.8.0) and dlz
with mysql database.

When I try to resolve a zone I receive a Non-authoritative answer. But the zone
is on the DB, and all other things looks good.

$ nslookup -query=soa comune.ostuni.br.it dns1.convenzionefonia4.it
Server:dns1.convenzionefonia4.it
Address:31.199.7.28#53

Non-authoritative answer:
comune.ostuni.br.it
origin = dns1.convenzionefonia4.it
mail addr = hostmaster.comune.ostuni.br.it
serial = 1361204190
refresh = 10800
retry = 7200
expire = 604800
minimum = 3600

Authoritative answers can be found from:
comune.ostuni.br.itnameserver = dns2.convenzionefonia4.it.
comune.ostuni.br.itnameserver = dns1.convenzionefonia4.it.

I need it will be authoritative. This is my config:
dlz "Consip Zones"{
        database "mysql
        {host=dns-vip dbname=dns user=dns pass=dns}
        {SELECT zone FROM records_db WHERE zone = '$zone$'}
        {SELECT ttl, type, mx_priority, IF(type = 'TXT', CONCAT('\"',data,'

decrement reference

Fabian von Romberg — 2013-02-17T01:48:43

Hi All,

Lately I have seen on my debug terminal the following:

decrement_reference: delete from rbt: 0x7fc15f22aaa0 1850d3d2.anydomain.com

What does this mean?

Thanks in advance and regards,

Fabian


------------------------------------------------------------------------------
The Go Parallel Website, sponsored by Intel - in partnership with Geeknet, 
is your hub for all things parallel software development, from weekly thought 
leadership blogs to news, videos, case studies, tutorials, tech docs, 
whitepapers, evaluation guides, and opinion stories. Check out the most 
recent posts - join the conversation now. http://goparallel.sourceforge.net/

Re: What determines what zones get passed to DLZ?

Evan Hunt — 2012-11-05T16:35:32

First it checks to see whether any zone defined with a zone statement
can answer the query, then it tries the cache (if any), then it tries
the DLZ driver.


No, a DLZ driver can actually contain many zones, and they can appear and
disappear in real time (that's why it's called DLZ -- "dynamically loadable
zones").

Incidentally, in BIND 9.10 (next year), we're changing things so that you
can declare more than one DLZ driver, and you can also have a zone
statement that specifies which DLZ driver the zone will be served from.

What determines what zones get passed to DLZ?

John Guthrie — 2012-11-05T02:53:21

Hello all,

I had a bit of a technical question.  I was wondering what determines which zones get passed to the dlz driver.  From simple testing, I have seen that any zone with a zone declaration get handled by that declaration, as opposed to the dlz driver.  However, does anything else just get passed to the dlz driver if it is declared?  Could a zone be handled by something else before being handled by dlz?  I was wondering because when you declare the dlz driver in the named.conf, there is no explicit mention of which zone is being handled by it, however, only one dlz driver declaration is allowed per DNS view.

Thanks in advance.

John Guthrie
jguthrie< at >book.com
This electronic mail message contains information that (a) is or 
may be CONFIDENTIAL, PROPRIETARY IN NATURE, OR OTHERWISE 
PROTECTED 
BY LAW FROM DISCLOSURE, and (b) is intended only for the use of 
the addressee(s) named herein.  If you are not an intended 
recipient, please contact the sender immediately and take the 
steps necessary to delete

Re: dns master-slave transfer

Kwasi Gyasi - Agyei — 2012-10-31T04:03:35

If I remember correctly only thing required is to indicate zones
master in slave configuration.

On Mon, Oct 29, 2012 at 11:03 AM, kavin <yjh625< at >gmail.com> wrote:

dns master-slave transfer

kavin — 2012-10-29T09:03:30

Hi all：

Now，I want transfer the zone data from the master dns serverto slave dns server ,the master dns use bind-dlz+mysql and the slave dns server use bind+file.

If anyone test it successfully？If successfully ,can you tell what set the named.conf ？thinks


ps：use bind-9.9.2 version



kavin ------------------------------------------------------------------------------
The Windows 8 Center - In partnership with Sourceforge
Your idea - your app - 30 days.
Get started!
http://windows8center.sourceforge.net/
what-html-developers-need-to-know-about-coding-windows-8-metro-style-apps/_______________________________________________
Bind-dlz-testers mailing list
Bind-dlz-testers< at >lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bind-dlz-testers

Re: dlz-bdbhpt-dynamic - a dlopen bdbhpt DLZ driver -- works!

Jan-Piet Mens — 2012-07-16T09:59:27

It certainly does, yes, and your driver works, too! :-)

A few notes:

1. I configured it incorrectly first, thinking arg3 was path to
   database name, whereupon BIND faults with below stack trace. My
   fault, obviously, but you might want to look into that.
2. I had to modify bdbhpt-populate.pl to change flags = DB_CREATE
   only. Running BDB 4.7. Don't know why that is, and don't really
   have time to investigate. (Sorry.)

Thanks for your help -- nice job!

Regards,

        -JP

Re: dlz-bdbhpt-dynamic - a dlopen bdbhpt DLZdriver

Mark Goldfinch — 2012-07-16T09:33:10

Greetings,

On 16 July 2012 21:16, Jan-Piet Mens <jpmens.dns< at >gmail.com> wrote:


Ah good catch, yes the original bdbhpt_driver.c called these ISC functions
directly and your linker is correctly picking up that they're not actually
present.

I've renamed "state" to "db" to save some work of renaming things
throughout the code, but I've just pushed a change which should correctly
call these helper functions as passed by the DLZ dlopen driver.

If you pull down another copy does it correctly link for you now?

Thanks,
Mark.
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/_______________________________________________
Bind-dlz-testers mailing list
Bind-dlz-testers< at >lists.

Re: dlz-bdbhpt-dynamic - a dlopen bdbhpt DLZ driver

Jan-Piet Mens — 2012-07-16T09:16:03

Mark,



No, it's not the Makefile.

Looking into this a bit deeper, the DLZ example from BIND -9.9.1 contrib
doesn't call dns_sdlz_putrr() directly. (Neither do I because I swiped
that code from the example.) E.g.:

        result = state->putrr(lookup, "TXT", 0, buf);

which results in (what's it called?: LAZY_LOADING) ?

Your code calls the function explicitly:

        result = dns_sdlz_putrr(lookup, pd.type, pd.ttl, pd.data);

and the linker, at least here, can't find that symbol.

If I add the following huge pile of libs, I can get it to link:

        $(CC) $(CFLAGS) -shared -o dlz_bdbhpt_dynamic.so dlz_bdbhpt_dynamic.o \
                $(BDB_LIBS) \
                -lisc -ldns -lssl \             # ISC stuff 
                -lcrypto -lkrb5 -lxml2          # required for above

Just wanted to get that off to you. I'll test a bit now.

        -JP

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the wa

Re: dlz-bdbhpt-dynamic - a dlopen bdbhpt DLZdriver

Mark Goldfinch — 2012-07-16T08:21:51

Hi Jan-Piet,

On 16 July 2012 19:18, Jan-Piet Mens <jpmens.dns< at >gmail.com> wrote:


Thanks :-) I'm hoping it ends up being useful.



The missing symbols your linker is complaining about are internal ones
generated by the compiler?  Those particular symbols appear to be ones
within the source proceeded by _.

I suspect this is coming about because I'm building the shared object in
one go, and not building the plain object file first.


dlz_lua.so: dlz_lua.o
        $(CC) $(CFLAGS) -shared -o dlz_lua.so dlz_lua.o -L$(LUA) -llua

note the lack of dlz_lua.o definition though.  Where-as from mine:

dlz_bdbhpt_dynamic.so:
        $(CC) $(CFLAGS) -shared -o dlz_bdbhpt_dynamic.so
dlz_bdbhpt_dynamic.c $(BDB_LIBS)

Could you try modifying the Makefile to be:

dlz_bdbhpt_dynamic.so: dlz_bdbhpt_dynamic.o
        $(CC) $(CFLAGS) -shared -o dlz_bdbhpt_dynamic.so
dlz_bdbhpt_dynamic.c $(BDB_LIBS)

to see whether that makes any difference for you?


Well yes, a working read-only implementation to start with is my first
goal.

Re: dlz-bdbhpt-dynamic - a dlopen bdbhpt DLZ driver

Jan-Piet Mens — 2012-07-16T07:18:09

Mark,


That looks pretty slick. 

I can't for the life of me link the module, though. I'm running on OS/X
10.6 and both DLZ example (from BIND 9.9.1-P1 contrib) and my own [1]
link fine with dlz-minimal (V2).

|   cc -fPIC -g -I. -I/usr/local/BerkeleyDB.4.7/include -shared -o \
|        dlz_bdbhpt_dynamic.so dlz_bdbhpt_dynamic.c \
|        -L/usr/local/BerkeleyDB.4.7/lib -ldb 
|   Undefined symbols:
|     "_dns_sdlz_putnamedrr", referenced from:
|         _dlz_allnodes in ccHsui8i.o
|     "_dns_sdlz_putrr", referenced from:
|         _dlz_lookup in ccHsui8i.o
|   ld: symbol(s) not found

This must be due to lack of morning coffee...


Now, about the last bit of that comment in the source... ;-) 

Regards,

        -JP

[1] https://github.com/jpmens/dlz_lua

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions

dlz-bdbhpt-dynamic - a dlopen bdbhpt DLZ driver

Mark Goldfinch — 2012-07-16T02:39:07

Hi everyone,

Over the weekend I've taken it upon myself to write up a dlopen() capable
bdbhpt DLZ driver.

My repository with my resulting work is here:
https://github.com/goldie80/dlz-bdbhpt-dynamic

I'd appreciate any feedback on my work.

Thanks,
Mark.
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/_______________________________________________
Bind-dlz-testers mailing list
Bind-dlz-testers< at >lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bind-dlz-testers

Re: DLZ with cacher

Jorgen Lundman — 2012-07-04T23:02:45


Todd Lyons wrote:

With a TTL of 60, or 600, or whatever short value you can imagine, I would 
be happy if it use that for updates. It sort of already does, with all the 
other non-DLZ named out there that caches lookups.

But anyway, bind has no "proxy" mode where it will keep "aa" flags, and 
ignore norec to forward anyway.

But, it was only 2 line change to hack around that.

Lund

Re: DLZ with cacher

Evan Hunt — 2012-07-04T22:35:37

rndc flush, rndc flushname, or (in recent releases) rndc flushtree.
Or just using a relatively short TTL.


There are other reasons for DLZ to be useful, though.

Re: DLZ with cacher

Todd Lyons — 2012-07-04T17:14:27

This question has been asked many times over the course of the years
of the Bind-DLZ patch.  The answer was always to configure the backend
(ldap or sql) for optimum caching and leave the bind frontend just a
parser to construct the appropriate query and return the appropriate
answer to the querier.  The very nature of bind-dlz is that a change
on the backend data is immediately visible on the frontend.  But if
you're caching lookups, how would you then make bind actually use that
changed data?  rndc reload?  That was the main reason I went *to* the
DLZ patch, to get away from cronjobs and zone rebuild scripts.

...Todd

Re: DLZ with cacher

Jorgen Lundman — 2012-07-04T08:58:10

Actually, it is no good for when you are hosting domains. Since DLZ view 
will set flag "aa" (authoritative) but the forwarder-view will clear it.

I don't see any way to force forwarder to keep/set flag 'aa' when replying.

Lund

Jan-Piet Mens wrote: