© 2004
Canonical Ltd.
•
Terms of use
•
Data privacy
•
Contact Launchpad Support
•
Blog
•
Careers
•
System status
•
1b1ed1a
(Get the code!)
Ok testing zesty on my own then, verified with three KVM guests:
dns1 192.168.122.79
dns2 192.168.122.225
zesty 192.168.122.220
# basic servers
$ sudo apt-get install bind9 bind9utils bind9-doc
/etc/bind/
zone "paelzertest1.lan" {
type master;
file "/etc/bind/
};
zone "1.168.
type master;
file "/etc/bind/
};
The other one the same but with a 2 instead of a 1
Also the forwar/reverse zones with 1 on dns1 and 2 on dns2
/etc/bind/
$TTL 86400
@ IN SOA pri.paelzertest
2011071001 ;Serial
3600 ;Refresh
1800 ;Retry
604800 ;Expire
86400 ;Minimum TTL
)
@ IN NS pri.paelzertest
@ IN A 192.168.1.200
@ IN A 192.168.1.201
pri IN A 192.168.1.200
test IN A 192.168.1.200
/etc/bind/
$TTL 86400
@ IN SOA pri.paelzertest
2011071002 ;Serial
3600 ;Refresh
1800 ;Retry
604800 ;Expire
86400 ;Minimum TTL
)
@ IN NS pri.paelzertest
@ IN PTR paelzertest1.lan.
pri IN A 192.168.1.200
test IN A 192.168.1.201
200 IN PTR pri.paelzertest
201 IN PTR test.paelzertes
Disable recursion by adding the following to /etc/bind/
allow-transfer {"none";};
allow-recursion {"none";};
recursion no;
$ sudo systemctl restart bind9
This is now having dns1 only answering for test.paelzertes
Example:
$ dig test.paelzertes
; <<>> DiG 9.10.3-P4-Ubuntu <<>> test.paelzertes
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 62119
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;test.paelzerte
;; Query time: 0 msec
;; SERVER: 192.168.
;; WHEN: Tue Nov 07 07:14:52 UTC 2017
;; MSG SIZE rcvd: 50
ubuntu@
; <<>> DiG 9.10.3-P4-Ubuntu <<>> test.paelzertes
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37335
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
;; WARNING: recursion requested but not available
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;test.paelzerte
;; ANSWER SECTION:
test.paelzertes
;; AUTHORITY SECTION:
paelzertest2.lan. 86400 IN NS pri.paelzertest
;; ADDITIONAL SECTION:
pri.paelzertest
;; Query time: 0 msec
;; SERVER: 192.168.
;; WHEN: Tue Nov 07 07:14:56 UTC 2017
;; MSG SIZE rcvd: 100
Now we configure dnsmasq as dns server and with a config to reach out to those two dns servers we prepared.
$ sudo vim /etc/resolv.
nameserver 192.168.122.79
nameserver 192.168.122.225
$ sudo dnsmasq --resolv-
This should give you a dnsmasq asking our two servers, running locally (in foreground with debug enabled).
On a second console on the test system with dnsmasq now use dig to query the dnsmasq that will then ask the two binds we have.
So for something that fails for sure on both we get:
$ dig foo @127.0.0.1
; <<>> DiG 9.10.3-P4-Ubuntu <<>> foo @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 42311
On the server we see:
dnsmasq: query[A] foo from 127.0.0.1
dnsmasq: forwarded foo to 192.168.122.79
dnsmasq: forwarded foo to 192.168.122.225
That works for the Xenial Test.
Now this is a bit of a race, run sime loacl requests and sometimes you get the combo:
$ dig test.paelzertes
; <<>> DiG 9.10.3-P4-Ubuntu <<>> test.paelzertes
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 953
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
sever log:
dnsmasq: query[A] test.paelzertes
dnsmasq: forwarded test.paelzertes
dnsmasq: forwarded test.paelzertes
This should not happen (and doesn't with the fix).
For Zesty to force the issue (since it has one of the two patches already) we need to force "SERVFAIL".
Unfortunately this fail has to be faster than the valid reply to trigger the race (it would then consider fail success and reply without waiting for the good answer).
To get an answer a bind has to run, but to get a SERVFAIL instead of an NXDOMAIN it will need a definition for that zone.
So copy /etc/bind/
Then make it known in /etc/bind/
Finally "break" it intentional e.g. by changing the leading "$TTL" to "TTL".
That way bind works (one good zone) and serves paelzertest1 namespace (registered the conf) but it fails.
Status should show like:
named[3534]: zone paelzertest1.
Now dns1 gives me NOERROR but dns2 gives SERVFAIL for
dig test.paelzertes
; <<>> DiG 9.10.3-P4-Ubuntu <<>> test.paelzertes
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 36187
Disable caching to open the window of the race further.
Further we need to set --all-servers, otherwise it would almost randomly iterate.
$ sudo dnsmasq --resolv-
That gives SERVFAIL when querying the dnsmasq server.
$ dig test.paelzertes
; <<>> DiG 9.10.3-P4-Ubuntu <<>> test.paelzertes
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 27511
Log from the server:
dnsmasq: query[A] test.paelzertes
dnsmasq: forwarded test.paelzertes
=> It didn't try the next as it considered SERVFAIL to be ok successful as an answer.
Installing the version from proposed resolves that.
$ dig test.paelzertes
; <<>> DiG 9.10.3-P4-Ubuntu <<>> test.paelzertes
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43539
Server-log:
dnsmasq: query[A] test.paelzertes
dnsmasq: forwarded test.paelzertes
dnsmasq: forwarded test.paelzertes
dnsmasq: reply test.paelzertes
With that - set verification-done