bind9 can't load preinstalled plugins

[rwruck]

[Impact]

When a user provides the name of an existing bind9 plugin to /etc/bind/named.conf.options, it fails to recognize it. This is because named is searching in the wrong folder - /usr/lib/x86_64-linux-gnu/named/ instead of the correct location /usr/lib/x86_64-linux-gnu/bind/.

This fix should be added to Jammy to maintain the correct behavior for named plugin configurations.

The fix will be provided by the minor release update described in (LP: #2003586)

[Test Plan]

# lxc launch images:ubuntu/jammy test-bind9
# lxc exec test-bind9 bash
# apt update && apt dist-upgrade
# apt install bind9
# cat <<EOF >/etc/bind/named.conf.options
options {
        directory "/var/cache/bind";
        dnssec-validation auto;
        listen-on-v6 { any; };
};
plugin query "filter-aaaa.so" {
        filter-aaaa-on-v4 yes;
};
EOF
# named-checkconf
- Before the update this fails since named is looking for filter-aaaa.so in /usr/lib/x86_64-linux-gnu/named instead of the correct location /usr/lib/x86_64-linux-gnu/bind. After the fix named-checkconf succeeds.

[Where problems could occur]

Problems can occour in multiple areas outside of this fix since it will be a part of a minor release update. However, issues directly associated with this fix would likely arise in plugin activation, which can be checked using named-checkconf.

[Other Info]

The fix for this issue exists in Kinetic prior to its equivalent minor release update.

[Original Description]

Ubuntu release: 22.04.1 LTS (jammy) amd64
bind9 version: 1:9.18.1-1ubuntu1.3

bind9 comes with the plugins filter-a.so and filter-aaaa.so preinstalled into /usr/lib/x86_64-linux-gnu/bind/.
When trying to actually use them, bind9 fails to start:

loading plugin '/usr/lib/x86_64-linux-gnu/named/filter-aaaa.so'
failed to dlopen() plugin '/usr/lib/x86_64-linux-gnu/named/filter-aaaa.so': /usr/lib/x86_64-linux-gnu/named/filter-aaaa.so: cannot open shared object file: No such file or directory

Looks like either bind9 is configured with a wrong plugin path or the files got dropped into the wrong directory.

To reproduce, add the following to /etc/bind/named.conf.options and restart:

plugin query "filter-aaaa.so" {
    filter-aaaa-on-v4 yes;
};

Workaround: Use the full path like in

plugin query "/usr/lib/x86_64-linux-gnu/bind/filter-aaaa.so" {
    filter-aaaa-on-v4 yes;
};

[Lena Voytek (lvoytek)]

Thank you for the bug report. I can confirm this is currently the case in Ubuntu 22.04:

# lxc launch images:ubuntu/jammy test-bind9
# lxc exec test-bind9 bash
# apt update && apt dist-upgrade
# apt install bind9

# cat <<EOF >/etc/bind/named.conf.options
options {
        directory "/var/cache/bind";
        dnssec-validation auto;
        listen-on-v6 { any; };
};
plugin query "filter-aaaa.so" {
        filter-aaaa-on-v4 yes;
};
EOF

# named-checkconf
/etc/bind/named.conf.options:29: /usr/lib/x86_64-linux-gnu/named/filter-aaaa.so: plugin check failed: failure
root@quicktest:~# apt install software-properties-common

Luckily this should be fixed soon with the upcoming minor release update for bind9: (LP: #2003586).
Testing with the PPA https://launchpad.net/~lvoytek/+archive/ubuntu/bind9-mre confirms this.

[Steve Langasek (vorlon)]

Hello rwruck, or anyone else affected,

Accepted bind9 into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/bind9/1:9.18.12-0ubuntu0.22.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Lena Voytek (lvoytek)]

Confirmed the MRE fixed this issue for Jammy:

# lxc launch images:ubuntu/jammy test-bind9
# lxc exec test-bind9 bash

# cat <<EOF >/etc/apt/sources.list.d/ubuntu-$(lsb_release -cs)-proposed.list
# Enable Ubuntu proposed archive
deb http://archive.ubuntu.com/ubuntu/ $(lsb_release -cs)-proposed restricted main multiverse universe
EOF

# apt update && apt dist-upgrade
# apt install bind9

# cat <<EOF >/etc/bind/named.conf.options
options {
        directory "/var/cache/bind";
        dnssec-validation auto;
        listen-on-v6 { any; };
};
plugin query "filter-aaaa.so" {
        filter-aaaa-on-v4 yes;
};
EOF

# named-checkconf

No output - good to go

[Launchpad Janitor (janitor)]

This bug was fixed in the package bind9 - 1:9.18.12-0ubuntu0.22.04.1

---------------
bind9 (1:9.18.12-0ubuntu0.22.04.1) jammy; urgency=medium

  * New upstream releases 9.18.2 - 9.18.12 (LP: #2003586)
    - Updates:
      + update-quota option
      + named -V shows supported cryptographic algorithms
      + Catalog Zones schema version 2 support in named
      + DNS error support Stale Answer and Stale NXDOMAIN Answer
      + Remote TLS certificate verification support
      + reusereport option
    - Bug Fixes Include:
      + Fix crash when using dig with +nssearch and +tcp (LP: #1258003)
      + Fix incomplete results using dig with +nssearch (LP: #1970252)
      + Fix loading of preinstalled plugins (LP: #2006972)
      + CVE-2022-2795, CVE-2022-2881, CVE-2022-2906, CVE-2022-3080,
        CVE-2022-38178, CVE-2022-3094, CVE-2022-3736, CVE-2022-3924,
        CVE-2022-1183
      + Fix thread safety in dns_dispatch
      + Fix ADB quota management in resolver
      + Fix Prohibited DNS error on allow-recursion
      + Fix crash when restarting server with active statschannel connection
      + Fix use after free for catalog zone processing
      + Fix leak of dns_keyfileio_t objects
      + Fix nslookup failure to use port option when record type ANY is used
      + Fix crash on dnssec-policy zone with NSEC3 and inline-signing turned on
      + Fix inheritance when setting remote server port
      + Fix assertion error when accessing statistics channel
      + Fix rndc dumpdb -expired for stuck cache
      + Fix check for other name servers after receiving FORMERR
      + Fix deletion of CDS after zone sign
      + Fix dighost query context management
      + Fix dig hanging due to IPv4 mapped IPv6 address
      + See https://bind9.readthedocs.io/en/v9_18_12/notes.html#notes-for-bind-9-18-12
        for additional bug fixes and information
  * Improve dep-8 test suite (LP: #2003584):
    - d/t/zonetest: Add dep8 test for checking the domain zone creation process
    - d/t/control: Add new test outline
  * d/bind9-doc.docs: Stop installing removed file doc/misc/options.active
  * Remove patches for bugs LP #1964400 and LP #1964686 fixed upstream:
    - lp1964400-lp1964686-Fix-an-issue-in-dig-when-retrying-with-the-next-serv
    - lp1964400-lp1964686-When-resending-a-UDP-request-insert-the-query-to-the
    - lp1964400-lp1964686-Add-digdelv-system-test-to-check-timed-out-result-fo
    - lp1964400-lp1964686-After-dig-request-errors-try-to-use-other-servers-wh
    - lp1964400-lp1964686-Add-digdelv-system-test-to-check-that-dig-tries-othe
    - lp1964400-lp1964686-Fix-dig-error-when-trying-the-next-server-after-a-TC
    - lp1964400-lp1964686-Add-various-dig-host-tests-for-TCP-UDP-socket-error-
  * Remove CVE patches fixed upstream:
    - debian/patches/CVE-2022-1183.patch
      [Included in upstream release 9.18.3]
    - debian/patches/CVE-2022-2795.patch
    - debian/patches/CVE-2022-2881.patch
    - debian/patches/CVE-2022-2906.patch
    - debian/patches/CVE-2022-3080.patch
    - debian/patches/CVE-2022-38178.patch
      [Included in upstream release 9.18.7]
    - debian/patches/CVE-2022-3094.patch
    - debian/patches/CVE-2022-3736.patch
    -...

[Chris Halse Rogers (raof)]

The verification of the Stable Release Update for bind9 has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.