Your message dated Sun, 21 Jul 2019 21:55:01 +0000
with message-id <[email protected]>
and subject line Bug#916408: fixed in pdns 4.2.0~rc2-1
has caused the Debian Bug report #916408,
regarding pdns-server: TCP client queries to pdns-server with any backend ipv6
recursor fail
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
916408: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=916408
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: pdns-server
Version: 4.0.3-1+deb9u2
Severity: normal
Dear Maintainer,
pdns-server in Stretch fails to answer TCP queries made by clients via backend
recursors reached over IPv6. I discovered this setting up cloudflared, using it
as the recursor, but have also replicated on a clean install with Google and
Cloudflare's public DNS servers.
NB: test addresses used below:
CF DNS: 1.1.1.1 (ipv4), 2606:4700:4700::1111 (ipv6)
Google DNS: 8.8.8.8 (ipv4), 2001:4860:4860::8888 (ipv6)
Up to date just-installed Stretch x64 server:
root@pdnsbugtest:~# lsb_release -a
No LSB modules are available.
Distributor ID: Debian
Description: Debian GNU/Linux 9.6 (stretch)
Release: 9.6
Codename: stretch
root@pdnsbugtest:~# uname -a
Linux pdnsbugtest 4.9.0-8-amd64 #1 SMP Debian 4.9.130-2 (2018-10-27) x86_64
GNU/Linux
root@pdnsbugtest:~# apt update && apt full-upgrade
Hit:1 http://security.debian.org/debian-security stretch/updates InRelease
Ign:2 http://ftp.uk.debian.org/debian stretch InRelease
Hit:3 http://ftp.uk.debian.org/debian stretch-updates InRelease
Hit:4 http://ftp.uk.debian.org/debian stretch Release
Reading package lists... Done
Building dependency tree
Reading state information... Done
All packages are up to date.
Reading package lists... Done
Building dependency tree
Reading state information... Done
Calculating upgrade... Done
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Only packages installed on top of base (base Debian server with
openssh-server): vim, open-vm-tools, dnsutils, pdns-server
root@pdnsbugtest:~# pdns_server --version
Dec 13 23:48:43 PowerDNS Authoritative Server 4.0.3 (C) 2001-2016 PowerDNS.COM
BV
Dec 13 23:48:43 Using 64-bits mode. Built using gcc 6.3.0 20170516.
Dec 13 23:48:43 PowerDNS comes with ABSOLUTELY NO WARRANTY. This is free
software, and you are welcome to redistribute it according to the terms of the
GPL version 2.
Dec 13 23:48:43 Features: botan1.10 openssl lua
Dec 13 23:48:43 Built-in modules:
Dec 13 23:48:43 Configured with: " '--build=x86_64-linux-gnu' '--prefix=/usr'
'--includedir=${prefix}/include' '--mandir=${prefix}/share/man'
'--infodir=${prefix}/share/info' '--sysconfdir=/etc' '--localstatedir=/var'
'--disable-silent-rules' '--libdir=${prefix}/lib/x86_64-linux-gnu'
'--libexecdir=${prefix}/lib/x86_64-linux-gnu' '--disable-maintainer-mode'
'--disable-dependency-tracking' '--sysconfdir=/etc/powerdns'
'--with-dynmodules=bind ldap pipe gmysql godbc gpgsql gsqlite3 geoip lua mydns
remote random opendbx tinydns' '--with-modules='
'--with-pgsql-includes=/usr/include/postgresql' '--enable-botan1.10'
'--enable-tools' '--without-protobuf' '--enable-unit-tests'
'--enable-reproducible' '--enable-systemd' '--with-systemd=/lib/systemd/system'
'build_alias=x86_64-linux-gnu' 'CFLAGS=-g -O2
-fdebug-prefix-map=/build/pdns-cB0QhU/pdns-4.0.3=. -fstack-protector-strong
-Wformat -Werror=format-security' 'LDFLAGS=-Wl,-z,relro' 'CPPFLAGS=-Wdate-time
-D_FORTIFY_SOURCE=2' 'CXXFLAGS=-g -O2
-fdebug-prefix-map=/build/pdns-cB0QhU/pdns-4.0.3=. -fstack-protector-strong
-Wformat -Werror=format-security
-DPACKAGEVERSION='\''"4.0.3-1+deb9u2.Debian"'\'''"
Standard pdns.conf, plus 2 config variables to enable recursion ('recursor',
'allow-recursion'):
root@pdnsbugtest:~# grep -v "^$\|^#" /etc/powerdns/pdns.conf
allow-recursion=0.0.0.0/0,::/0
include-dir=/etc/powerdns/pdns.d
launch=
recursor=1.1.1.1
security-poll-suffix=
setgid=pdns
setuid=pdns
Now, we can test. First, direct to CF and then via pdns, with and without TCP,
over ipv4:
root@pdnsbugtest:~# grep recursor= /etc/powerdns/pdns.conf; dig +short +notcp
google.com @1.1.1.1; dig +short +tcp google.com @1.1.1.1; dig +short +notcp
google.com @127.0.0.1; dig +short +tcp google.com @127.0.0.1
recursor=1.1.1.1
216.58.206.142
216.58.206.142
216.58.206.142
216.58.206.142
Now the same, but with Google:
root@pdnsbugtest:~# grep recursor= /etc/powerdns/pdns.conf; dig +short +notcp
google.com @8.8.8.8; dig +short +tcp google.com @8.8.8.8; dig +short +notcp
google.com @127.0.0.1; dig +short +tcp google.com @127.0.0.1
recursor=8.8.8.8
216.58.206.110
216.58.206.110
216.58.206.110
216.58.204.78
All good. Now let's try with CF's ipv6 server as the recursor:
[root@pdnsbugtest:~# grep recursor= /etc/powerdns/pdns.conf; dig +short +notcp
google.com @2606:4700:4700::1111; dig +short +tcp google.com
@2606:4700:4700::1111; dig +short +notcp google.com @127.0.0.1; dig +short +tcp
google.com @127.0.0.1
recursor=2606:4700:4700::1111
216.58.206.110
216.58.206.110
216.58.206.110
;; communications error to 127.0.0.1#53: end of file
Uh-oh. What about Google?
[root@pdnsbugtest:~# grep recursor= /etc/powerdns/pdns.conf; dig +short +notcp
google.com @2001:4860:4860::8888; dig +short +tcp google.com
@2001:4860:4860::8888; dig +short +notcp google.com @127.0.0.1; dig +short +tcp
google.com @127.0.0.1
recursor=2001:4860:4860::8888
216.58.212.110
216.58.212.110
216.58.212.110
;; communications error to 127.0.0.1#53: end of file
Hmm, and what about ipv6 at the front-end?
root@pdnsbugtest:~# grep recursor= /etc/powerdns/pdns.conf; dig +short +notcp
google.com @::1; dig +short +tcp google.com @::1
recursor=2001:4860:4860::8888
216.58.212.110
;; communications error to ::1#53: end of file
Looks like it's specifically ipv6 at the backend, in combination with TCP at
the front-end that is broken. A full dig output is no more revealing:
root@pdnsbugtest:~# dig +tcp google.com @::1
;; communications error to ::1#53: end of file
Let me know if you need more info or can't reproduce, I'm happy to assist.
Kind regards,
Nick
-- System Information:
Debian Release: 9.6
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 4.9.0-8-amd64 (SMP w/1 CPU core)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8),
LANGUAGE=en_GB:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages pdns-server depends on:
ii adduser 3.115
ii init-system-helpers 1.48
ii libboost-program-options1.62.0 1.62.0+dfsg-4
ii libbotan-1.10-1 1.10.16-1
ii libc6 2.24-11+deb9u3
ii libgcc1 1:6.3.0-18+deb9u1
ii liblua5.3-0 5.3.3-1
ii libsqlite3-0 3.16.2-5+deb9u1
ii libssl1.1 1.1.0j-1~deb9u1
ii libstdc++6 6.3.0-18+deb9u1
ii libsystemd0 232-25+deb9u6
Versions of packages pdns-server recommends:
ii pdns-backend-bind 4.0.3-1+deb9u2
Versions of packages pdns-server suggests:
ii pdns-backend-bind [pdns-backend] 4.0.3-1+deb9u2
-- Configuration Files:
/etc/powerdns/pdns.conf [Errno 13] Permission denied: '/etc/powerdns/pdns.conf'
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: pdns
Source-Version: 4.2.0~rc2-1
We believe that the bug you reported is fixed in the latest version of
pdns, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Chris Hofstaedtler <[email protected]> (supplier of updated pdns package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Sun, 21 Jul 2019 20:59:16 +0000
Source: pdns
Architecture: source
Version: 4.2.0~rc2-1
Distribution: experimental
Urgency: medium
Maintainer: pdns packagers <[email protected]>
Changed-By: Chris Hofstaedtler <[email protected]>
Closes: 876775 916408 918661
Changes:
pdns (4.2.0~rc2-1) experimental; urgency=medium
.
* New upstream version 4.2.0~rc2 (Closes: #918661, #916408)
* Bump Standards-Version to 4.4.0
* Use debhelper-compat v12
* Revert "Link with libatomic.so to fix build failure on armel"
* Ship DEP12 UpstreamMetadata per user request
* Remove pdns-backend-opendbx.
OpenDBX is unmaintained in Debian and possibly upstream, too.
* Use pdns_control rping in init script.
Makes the init script useful on systemd systems, too. (Closes: #876775)
* autopkgtests: add more guessed workarounds for debci
* Build-Depend on systemd for proper version detection
* Remove preinst code for upgrades from before 4.0.0-3
* Remove ddeb/dbgsym breaks, from before 4.0.0
* d/control: simplify Build-Depends and remove old Breaks/Replaces
* d/rules: simplify and sync with dnsdist, pdns-recursor
* pdns-ixfrdist: Add ixfrdist init script
* backends: take schema files from `make install` location
* pdns-tools: install dnspcap2calidns, stubquery
Checksums-Sha1:
2d07cad3889c57269a7c57a57a2c91285429397a 3294 pdns_4.2.0~rc2-1.dsc
4ac8c2df6ebbdec5f3fcb4bb763e20408d1e7f6d 1245187 pdns_4.2.0~rc2.orig.tar.bz2
1f45bfaa5451e17a9c2804910c83374118cc97ec 43784 pdns_4.2.0~rc2-1.debian.tar.xz
3263dfe7182ff1d073ed85ae07020ee166d8e565 8883 pdns_4.2.0~rc2-1_source.buildinfo
Checksums-Sha256:
b6c384a482189083a504b5545ff582c7251c242ed6a5cdc275896f446e2fc730 3294
pdns_4.2.0~rc2-1.dsc
6aafcd6e69e16675104f14f8ce61495be1d287f8058f67234b3b313ee34d5c00 1245187
pdns_4.2.0~rc2.orig.tar.bz2
b200a04c61422d317533333f9df906f6e612b9561f0ec407d537e95b7b509f3d 43784
pdns_4.2.0~rc2-1.debian.tar.xz
799d255ac9c9ddf63c21afedf7feeaaff06aa3f368caa3c4d8ffdcdc6374944e 8883
pdns_4.2.0~rc2-1_source.buildinfo
Files:
fd072db155c6116d71e3d29c09cafaf6 3294 net optional pdns_4.2.0~rc2-1.dsc
59f5ef5601035521daa726bddaac8aa6 1245187 net optional
pdns_4.2.0~rc2.orig.tar.bz2
df75eb343e40935fb98fa87e8b070978 43784 net optional
pdns_4.2.0~rc2-1.debian.tar.xz
c47527decb3fe765aa66327ce3da6e68 8883 net optional
pdns_4.2.0~rc2-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEfRrP+tnggGycTNOSXBPW25MFLgMFAl0013UACgkQXBPW25MF
LgPA5A//TQU3i1vnZfrtEIVeo6vxTb2+tA0KT4n8AZoSbDfUyHdq62jv36Lq4YUC
xsrVQTVmDIpQYRvFmZ+6P4CwgY1RUUunZ79T4aitXrvGUe7SqFVq/A6PAtZDviWj
ibpD2Cpx3WXppYc9XSKgL9YJGv6oIu/GtEQ2YSzLToRALgziP+wWmYWYonQpk31A
BtLd6qnjpZUQQM2iotSfgnz+tOwsi2KYWFibfEF9B/fqLdUaC8ISu6gqTx8TcWVx
1AZcqCsRSE7TIfAugQQbO5cKdTtdytHY8fNLzetg2V+pjJvxZlWD2akgTOUCK1Dz
AjxAD/FsVAWyzkMHtKcgFwUAVC+A1et+hkbqEirQfguRSBIk7RilqAqESU+gQbPH
qKWKmOcwNeKJLSW6jHVheE5RYK/SIedvXqqu8Y3XfaA2+ZVpn4Yt/8/CzUNmOnWo
c1IaZOT5IrZpWs3qn/MZPLYTV7UBhA8JAbUM6DKPEz0qPjerye8hHW1NqatiGwpn
uv4+vRiVFEQjHouX+7XE8ADtzpqVDtDpjbodeyWsAJkvRmGjytfjYUln09Wh8zvz
bn56p0C+4NhYMV+MBvlimVhnq3x7IuDF5crfDyeUrLViNo10g+TK7nEl5dmmEtR6
tDB5zN3m+SQg9oLviwteGYV5Jk8OMTEccDeIoXhQ50LlOJTOK3E=
=SqBu
-----END PGP SIGNATURE-----
--- End Message ---
