TSIG verify failure at DNS backend side

[Liang Rong]

Create a pool and configure the pool with a managed DNS backend (BIND9 in my case), and also create a TSIG key to identify the pool.

Next create zones in this pool. The zone transfer from MiniDNS to BIND9 fails because of TSIG verify failure at BIND9.

This issue is likely to be caused by the TSIG MAC generation in _handle_axfr function in mdns/handler.py. In this function, the request.request_mac should be replaced with request.mac. After I made this change, the TSIG verification is passed at BIND9 and zone transfer is completed successfully.

[Kiall Mac Innes (kiall)]

Looking into this, I'm not sure it warrants Private Security as it sounds like it's not leaking info / privilege escalation etc - but let's leave it private for now until we know for sure.

[Liang Rong (csulrong)]

Sorry, the Security option is mistakenly checked on.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/223524

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/223524
Committed: https://git.openstack.org/cgit/openstack/designate/commit/?id=da1fdf792ac926044ac79780a776a8caf669ca94
Submitter: Jenkins
Branch: master

commit da1fdf792ac926044ac79780a776a8caf669ca94
Author: sonu.kumar <email address hidden>
Date: Tue Sep 15 16:31:50 2015 +0530

    Replace request.request_mac with request.mac

    This patch replaces request.request_mac with request.mac
    to provide TSIG verification.

    Change-Id: Ide4f48dc3b4de7a919cc41abebf9843d0ba77763
    Closes-Bug: #1466300