http://blog.gmane.org/gmane.network.dns.powerdns.devel hourly 1 1901-01-01T00:00+00:00 http://gmane.org/img/gmane-25t.png http://gmane.org http://comments.gmane.org/gmane.network.dns.powerdns.devel/1209 <pre>Hi, Please find attached a patch for the issue I rambled on about in ticket 460. In short: when running a zone in presigned mode and querying a name for which only a matching *.domain.com record exists, PowerDNS does not add an RRSIG record to the result. The attached patch lets PowerDNS add the RRSIG record for the wildcard record with the same name as the original queried name, which is identical to the records PowerDNS returns when doing live signing. Kind regards, </pre> Sebastiaan Hoogeveen 2012-05-09T08:55:47 http://comments.gmane.org/gmane.network.dns.powerdns.devel/1206 <pre>-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi everybody, PowerDNS Authoritative Server 3.1 is now available! 3.1 is the best version of the PowerDNS Authoratitive Server currently available, and we recommend upgrading to it. Please read http://doc.powerdns.com/from3.0to3.1.html before you do, however! If you are coming from 2.9.x, please read http://doc.powerdns.com/upgrades.html#from2.9to3.0 in addition to the 3.0-&gt;3.1 notes. Please see http://doc.powerdns.com/changelog.html#changelog-auth-3-1 for full release notes and all download links. You can get PowerDNS 3.1 from: http://downloads.powerdns.com/releases/pdns-3.1.tar.gz http://downloads.powerdns.com/releases/deb/pdns-static_3.1-1_i386.deb http://downloads.powerdns.com/releases/deb/pdns-static_3.1-1_amd64.deb http://downloads.powerdns.com/releases/rpm/pdns-static-3.1-1.i386.rpm http://downloads.powerdns.com/releases/rpm/pdns-static-3.1-1.x86_64.rpm These files also come with GPG signatures (append .sig). Additionaly, Kees Monshouwer has kind</pre> Peter van Dijk 2012-05-04T11:35:37 http://comments.gmane.org/gmane.network.dns.powerdns.devel/1204 <pre>Hi All, My boss asked me to modify PNDS to be able to support DNS64 specification. DNS64 specification mandates DNS resolver to synthesize AAAA record from A record, if AAAA record is missing. I started with Lua script example of PDNS recursor. But i could not find any clue on how to get A record from nodata function parameters: http://wiki.powerdns.com/trac/browser/branches/pdns-dns64/pdns/powerdns-example-script.lua function nodata ( remoteip, domain, qtype, records ) print ("nodata called for: ", remoteip, getlocaladdress(), domain, qtype) if qtype ~= pdns.AAAA then return -1, {} end -- only AAAA records setvariable() return "getFakeAAAARecords", domain, "fe80::21b:77ff:0:0" -- here i need to return ::ffff:ipv4.dotted.decimal.format end I would like to do something like this ipv4 = "1.2.3.4" -- how do i get this data from recursor ??? ipv6 = "::ffff:" .. ipv4 -- synthesized representation of IPv4 in IPv6 return "getFakeAAARecords", domain, ipv6 My question is: - how do</pre> Muntasir Rahman 2012-05-04T04:47:50 http://comments.gmane.org/gmane.network.dns.powerdns.devel/1199 <pre>Hi, I made a question to pdns-user list about the AXFR notification of bindbackend and they said I should send a feature request. I was looking for a feature which can send Notify message not only to all IPs of NS records in zones but also to a list of IPs. I want to restrict the messages. How can I suggest this feature? I didn't find this solution on Trac, I haven't got account to it. Sincerely, Tibor </pre> Tibor Benke 2012-05-02T07:47:17 http://comments.gmane.org/gmane.network.dns.powerdns.devel/1190 <pre>-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear PowerDNS Authoritative Server users, Summary: DNSSEC keys generated with 3.1-RC1, RC2 and SVN builds between february 14th and april 28th may be weak. Earlier this week the PolarSSL team released version 1.1.2 of their library. This is a security release; their advisory is at http://polarssl.org/trac/wiki/SecurityAdvisory201201 PolarSSL 1.1.1 (which has the defects described in the advisory) was imported into PowerDNS SVN on february 14th, in revision 2396. This means that PowerDNS 3.0 was not using the affected version. We have confirmation from the PolarSSL team that the version of PolarSSL used in PowerDNS 3.0 is free of these issues. For PowerDNS, the issues in this advisory impact RSA key generation, which is the default for pdnssec secure-zone. PowerDNS 3.1-RC1 and RC2, and any build from SVN between revision 2396 and 2585, may be affected. If you have generated keys with any of these versions, assuming they were built with PolarSSL, we recommen</pre> Peter van Dijk 2012-04-28T16:53:37 http://comments.gmane.org/gmane.network.dns.powerdns.devel/1189 <pre>-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear PowerDNS Authoritative Server users, Summary: DNSSEC keys generated with 3.1-RC1, RC2 and SVN builds between february 14th and april 28th may be weak. Earlier this week the PolarSSL team released version 1.1.2 of their library. This is a security release; their advisory is at http://polarssl.org/trac/wiki/SecurityAdvisory201201 For PowerDNS, the issues in this advisory impact RSA key generation, which is the default for pdnssec secure-zone. PolarSSL 1.1.1 (which has the defects described in the advisory) was imported into PowerDNS SVN on february 14th, in revision 2396. This means that PowerDNS 3.0 was not using the affected version. We have confirmation from the PolarSSL team that the version of PolarSSL used in PowerDNS 3.0 is free of these issues. PowerDNS 3.1-RC1 and RC2, and any build from SVN between revision 2396 and 2585, are affected. If you have generated keys with any of these versions, we recommend replacing those keys. Make sure to replac</pre> Peter van Dijk 2012-04-28T14:53:00 http://comments.gmane.org/gmane.network.dns.powerdns.devel/1185 <pre>-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi everybody, Release Candidate 2 of the PowerDNS Authoritative Server 3.1 is available from: http://powerdnssec.org/downloads/pdns-3.1-rc2.tar.gz http://powerdnssec.org/downloads/packages/pdns-static-3.1rc2-1.i386.rpm http://powerdnssec.org/downloads/packages/pdns-static-3.1rc2-1.x86_64.rpm http://powerdnssec.org/downloads/packages/pdns-static_3.1-rc2-1_amd64.deb http://powerdnssec.org/downloads/packages/pdns-static_3.1-rc2-1_i386.deb Additionaly, Kees Monshouwer has kindly provided native builds for RHEL/CentOS 5 and 6 at http://www.monshouwer.eu/download/3rd_party/pdns-server/rc2/ You are cordially invited to (carefully) test this Release Candidate for correct behaviour. Specifically, if you are using any backends other than gmysql, gpgsql, gsqlite3 or bind, PLEASE test this candidate. Full release notes, with clickable links, will be available from: http://doc.powerdns.com/changelog.html#changelog-auth-3-1 Changes between RC1 and RC2: * We imported th</pre> Peter van Dijk 2012-04-14T15:07:19 http://comments.gmane.org/gmane.network.dns.powerdns.devel/1183 <pre>IANA has assigned the TLSA RR as 52. This patch keeps qtype sorted but leaves the method call in dnsrecords where it was. Please apply before the upcoming release. Index: pdns/pdns/qtype.cc =================================================================== --- pdns/pdns/qtype.cc(revision 2566) +++ pdns/pdns/qtype.cc(working copy) &lt; at &gt;&lt; at &gt; -66,6 +66,7 &lt; at &gt;&lt; at &gt; insert("DNSKEY", 48); insert("NSEC3", 50); insert("NSEC3PARAM", 51); + insert("TLSA",52); insert("SPF",99); insert("IXFR",251); insert("AXFR",252); &lt; at &gt;&lt; at &gt; -75,7 +76,6 &lt; at &gt;&lt; at &gt; insert("CURL",258); insert("ADDR",259); insert("DLV",32769); - insert("TLSA",65468); } } Index: pdns/pdns/dnsrecords.cc =================================================================== --- pdns/pdns/dnsrecords.cc(revision 2566) +++ pdns/pdns/dnsrecords.cc(working copy) &lt; at &gt;&lt; at &gt; -223,7 +223,7 &lt; at &gt;&lt; at &gt; conv.xfrBlob(d_certificate); ) -boilerplate_conv(TLSA, 65468, +boilerplate_conv(TLSA, 52, </pre> James Cloos 2012-04-13T22:27:54 http://comments.gmane.org/gmane.network.dns.powerdns.devel/1177 <pre>Hi everyone, With this configure command 3.0.1 compiles and works fine (for development anyway) on OS X Lion. 3.1rc2 aborts the compile with the error below. Ask $ ./configure --with-mysql-includes=/opt/local/include/mysql5 --with-mysql-lib=/opt/local/lib/mysql5 --with-boost=/opt/local --disable-recursor &amp;&amp; make -j4 [....] g++ -DHAVE_CONFIG_H -I. -I.. -Ibackends/bind -I/opt/local/include -DSYSCONFDIR=\"/usr/local/etc\" -DLIBDIR=\"/usr/local/lib\" -DLOCALSTATEDIR=\"/var/run\" -Ibackends/bind -Iext/polarssl-1.1.1/include -pthread -Wall -O2 -MT lua-pdns-recursor.o -MD -MP -MF .deps/lua-pdns-recursor.Tpo -c -o lua-pdns-recursor.o lua-pdns-recursor.cc In file included from mtasker.hh:27, from syncres.hh:21, from lua-pdns-recursor.cc:2: /usr/include/ucontext.h:43:2: error: #error The deprecated ucontext routines require _XOPEN_SOURCE to be defined In file included from mtasker.hh:114, from syncres.hh:21, from lua-pdns-recursor.cc:2: </pre> Ask Bjørn Hansen 2012-04-11T22:57:32 http://comments.gmane.org/gmane.network.dns.powerdns.devel/1172 <pre> ...And here is a patch for SunOS 5.10 (Solaris 10) for the above, (also as an attachment to this e-mail): --- pdns/ext/polarssl/library/net.c.orig        Mon Apr  2 13:38:22 2012 +++ pdns/ext/polarssl/library/net.c     Mon Apr  2 13:39:31 2012 &lt; at &gt;&lt; at &gt; -59,6 +59,8 &lt; at &gt;&lt; at &gt;  #include &lt;sys/endian.h&gt;  #elif defined(__APPLE__)  #include &lt;machine/endian.h&gt; +#elif defined(sun) +#include &lt;sys/isa_defs.h&gt;  #else  #include &lt;endian.h&gt;  #endif _______________________________________________ Pdns-dev mailing list Pdns-dev&lt; at &gt;mailman.powerdns.com http://mailman.powerdns.com/mailman/listinfo/pdns-dev </pre> a b 2012-04-02T17:56:03 http://comments.gmane.org/gmane.network.dns.powerdns.devel/1171 <pre> While trying to build pdns-3.0.1, it appears, from reading the responses on this mailing list, that it is recommended to use the OpenDBX backend to connect to various databases. The PowerDNS documentation states that the content on OpenDBX might be inaccurate or outdated and links to OpenDBX's own page with less than clear instructions ("go here", "patch that", no step by step documentation) are not of much help other than as general guidelines. The problem initially encountered is that the wording implies that OpenDBX is bundled with the pdns archive, and I think it would be helpful to explicitly state in the PowerDNS's documentation that on those operating systems which do not come with OpenDBX by default, OpenDBX libraries must first be built and installed before attempting to run ./configure with the opendbx backend. As things stand right now, the process involves trial and error to finally reach that conclusion. Is it OK to open a ticket for updating the PowerDNS documentation? </pre> a b 2012-04-02T15:22:55 http://comments.gmane.org/gmane.network.dns.powerdns.devel/1170 <pre> Hello, Looking at ticket #412 (http://wiki.powerdns.com/trac/ticket/412), it appears that the --without-lua issue has been closed, but running ./configure --without-lua on pdns-3.0.1 still fails. Patches are attached; in the hope that they might help diagnose the problem, and as it stands right now, they at least allow ./configure to complete. Should a ticket be (re)opened to backport the fix in #412 to pdns-3.0.1, as pdns-3.1 has not been released yet? _______________________________________________ Pdns-dev mailing list Pdns-dev&lt; at &gt;mailman.powerdns.com http://mailman.powerdns.com/mailman/listinfo/pdns-dev </pre> a b 2012-04-02T15:09:39 http://comments.gmane.org/gmane.network.dns.powerdns.devel/1168 <pre>Hi, just tried to compile pdns-3.1-rc1.20120327.2539 on NetBSD 6.0 beta and encountered the following issues: - several Makefile.am in modules don't include $(BOOST_CPPFLAGS) in AM_CPPFLAGS (when they should): geobackend, gsqlite3backend, gsqlitebackend and mongodbbackend - net/ethernet.h isn't available on NetBSD - including net/if.h and net/if_ether.h instead seems to work (not sure if this would also apply to other BSDs) diff -ur pdns-3.1-rc1.20120327.2539.orig/pdns/dnspcap.hh pdns-3.1-rc1.20120327.2539/pdns/dnspcap.hh --- pdns-3.1-rc1.20120327.2539.orig/pdns/dnspcap.hh2012-03-27 21:52:24.000000000 +0100 +++ pdns-3.1-rc1.20120327.2539/pdns/dnspcap.hh2012-04-01 13:45:53.000000000 +0100 &lt; at &gt;&lt; at &gt; -10,7 +10,12 &lt; at &gt;&lt; at &gt; #include &lt;netinet/in_systm.h&gt; #include &lt;netinet/ip.h&gt; #include &lt;netinet/udp.h&gt; +#if defined(__NetBSD__) +#include &lt;net/if.h&gt; +#include &lt;net/if_ether.h&gt; +#else #include &lt;net/ethernet.h&gt; +#endif #include &lt;vector&gt; #include &lt;boost/format.hpp&gt; #include "namespaces.hh" - sys/endian.h needs</pre> Christof Meerwald 2012-04-01T13:10:38 http://comments.gmane.org/gmane.network.dns.powerdns.devel/1160 <pre>My validating BIND caches are currently returning SERVFAIL while resolving queries for www.cpan.org. After traversing two CNAMEs, this name eventually points to cpan-global.l.develooper.org. The domain develooper.org is signed and serverd by develooper.org. 432000 IN NS ns1.us.bitnames.com. develooper.org. 432000 IN NS ns3.us.bitnames.com. develooper.org. 432000 IN NS ns2.us.bitnames.com. develooper.org. 432000 IN NS ns2.eu.bitnames.com. develooper.org. 432000 IN NS ns1.eu.bitnames.com. All of these servers are running PowerDNS 3.0.1. according to version.bind. l.develooper.org is a zone-cut. During validation, my caches are trying to proof whether this delegation is secure by checking for the DS record of l.develooper.org. This is what the authoritative servers for develooper.org return: ; &lt;&lt;&gt;&gt; DiG 9.8.1-P1 &lt;&lt;&gt;&gt; &lt; at &gt;ns1.us.bitnames.com l.develooper.org. ds +dnssec ; (1 server found) ;; global options: +cmd ;;</pre> Alexander Gall 2012-02-24T13:34:33 http://comments.gmane.org/gmane.network.dns.powerdns.devel/1158 <pre>Hello, as I was doing some tuning of my max-[packet]cache-entires settings, I tought it could be useful to get cache &amp; packet-cache hit ratio metrics also available via "rec_control get" command with only one call (in my case, values are fetched via snmp polling, associating snmp extends to a "rec_control get" command for each counter). Small patch proposal at the end of this mail. For more precision, ratio is returned as per one thousand. By the way, I was wondering what was the difference between SyncRes::s_queries and g_stats.qcounter ? On the stats log, packet cache hit ratio is computed with the first one, but some manual testings seem to show that packet cache hits / g_stats.qcounter would be a more accurate value ... </pre> GAVARRET, David 2012-02-08T16:43:16 http://comments.gmane.org/gmane.network.dns.powerdns.devel/1151 <pre>I have finished a very first version of the REST backend and added it to a repository: https://github.com/erikmuttersbach/PowerDNS-REST-Backend The list command is not yet implemented and I also have HTTPS support on my roadmap. Anyway, I am happy about feedback J Is there something like a repository for community extensions/backends? Cheers, Erik _______________________________________________ Pdns-dev mailing list Pdns-dev&lt; at &gt;mailman.powerdns.com http://mailman.powerdns.com/mailman/listinfo/pdns-dev </pre> Erik Muttersbach 2012-02-02T18:37:25 http://comments.gmane.org/gmane.network.dns.powerdns.devel/1142 <pre>Update to my mail ... forgot the error when starting pdns_server. $ ./pdns/pdns_server --launch=rest Jan 31 19:37:59 Reading random entropy from '/dev/urandom' Jan 31 19:37:59 Unable to load module '/usr/local/lib/librestbackend.so': /usr/local/lib/librestbackend.so: cannot open shared object file: No such file or directory Jan 31 19:37:59 dnsbackend unable to load module in rest $ ./pdns/pdns_server --list-modules Jan 31 19:38:59 Reading random entropy from '/dev/urandom' Modules available: bind geo gmysql pipe random Pipe should not be here, should it? -----Original Message----- From: erik&lt; at &gt;muttersbach.net Sent: Dienstag, 31. Januar 2012 19:34 To: 'pdns-dev&lt; at &gt;mailman.powerdns.com' Subject: Compiling a custom backend Hi, I would like to develop a custom backend that uses a HTTP rest service for resolving requests. So far I have made the following customizations in the source code, checked out from SVN: 1. In configure.ac I changed the line modules="gmysql geo" to modules="gmysql geo rest" 2. I creat</pre> erik< at >muttersbach.net 2012-01-31T18:39:29 http://comments.gmane.org/gmane.network.dns.powerdns.devel/1141 <pre>Hi, I would like to develop a custom backend that uses a HTTP rest service for resolving requests. So far I have made the following customizations in the source code, checked out from SVN: 1. In configure.ac I changed the line modules="gmysql geo" to modules="gmysql geo rest" 2. I created a new folder under modules called restbackend with two source files: restbackend.cc (http://pastebin.com/CmFhVJP4) and restbackend.hh (http://pastebin.com/G1aDGRHt) and empty file OBJECTLIBS a file OBJECTFILES with the content "restbackend.o". Running ./bootstrap, ./configure and then make works well. Unfortunately the command ./pdns/pdns_server --launch=rest will fail with the following message: Whats wrong or missing here? Thanks, Erik </pre> erik< at >muttersbach.net 2012-01-31T18:34:13 http://comments.gmane.org/gmane.network.dns.powerdns.devel/1140 <pre>After: :; pdnssec add-zone-key example.net zsk ecdsa256 I get: :; pdnssec show-zone example.net Zone has hashed NSEC3 semantics, configuration: 1 1 1 ab Zone is not presigned keys: ... [ previous keys elided ] ... ID = 888 (ZSK), tag = 8888, algo = 8, bits = 256 Active: 0 and: :; dig &lt; at &gt;localhost example.net. dnskey +tcp ... [ other data elided ] ... example.net. 3600 IN DNSKEY 256 3 8 AAA= (I've confirmed that the dig results I elided match the previous ksk and zsk keys I also elided. Those previous keys are algo=8 and are reported correcly as such.) (The ID, tag and name were changed to protect the innocent. :) I also tried using gost, but that errored out as unrecognized. I'm currently running the version in debian sid: pool/main/p/pdns/pdns-server_3.0-1.1_i386.deb -JimC </pre> James Cloos 2012-01-27T11:35:38 http://comments.gmane.org/gmane.network.dns.powerdns.devel/1136 <pre>Hello, we are using PowerDNS server on all DNS servers in our company but as we decided to upgrade to latest stable release 3.0.1 few days ago we are not able to start the pdns server because of this error: Communicator thread died because of STL error: Creating local resolver socket for ::: Address family not supported by protocol I was trying to find more information how to fix this but I couldn't find much about this except for someone who tried to change #define HAVE_IPV6 1 to 0 in config.h before compiling which we also tried but with no success. I understand this is a ipv6 problem and we have ip6 support disabled on all our production server as we are using ipv4 only. We're currently running PowerDNS 2.9.22 without problems. All servers are running on Centos 5.7 Is there a hope we could upgrade to 3.x version without enabling ipv6 support on our production servers ? I don't think this would be possible in our company due to security concerns. Thank you Regards Thomas </pre> Tomáš Brandýský 2012-01-18T14:37:28 http://comments.gmane.org/gmane.network.dns.powerdns.devel/1133 <pre>-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi *, I'm doing a small academic study on DANE/TLSA and came across the following: The current implementation sends (as far as I can see) incorrect data. The record returned is larger than the actual data and does not match. - --------------------------------------------- $ drill _443._tcp.dane.kiev.practicum.os3.nl. TYPE65468 &lt; at &gt;kiev.studlab.os3.nl ;; -&gt;&gt;HEADER&lt;&lt;- opcode: QUERY, rcode: NOERROR, id: 29600 ;; flags: qr aa rd ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;; _443._tcp.dane.kiev.practicum.os3.nl. IN TYPE65468 ;; ANSWER SECTION: _443._tcp.dane.kiev.practicum.os3.nl. 300 IN TYPE65468 \# 99 010002f3579eedfe9cd1e71ce9bd3d6fbefce5af78d7c7f9e38df675eeb7d1d779e1d73a79ef5eddce3d75ee78efbd3c776dfa778738d777377bdedee387fdebd7badf9f79f1a6b8d74e3de7ce38d76edcd38f3cdf9d377b96f4db871fedaf1fe9af78 ;; AUTHORITY SECTION: ;; ADDITIONAL SECTION: ;; Query time: 2 msec ;; SERVER: 145.100.104.48 ;; WHEN: Mon Jan 16 1</pre> Pieter Lexis 2012-01-16T22:52:51 Search the mailing list at Gmane query http://search.gmane.org/?group=$group=gmane.network.dns.powerdns.devel