9.14.0 filter-aaaa

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
4 messages Options
Reply | Threaded
Open this post in threaded view
|

9.14.0 filter-aaaa

Bind-Users forum mailing list
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

view "normal" {
    plugin query "filter-aaaa.so" {
        filter-aaaa-on-v4 yes;
        filter-aaaa { "brokenv6"; };
    };
....

named-checkconf likes that, but named gets a segfault in filter-aaaa.so.
Anyone using filter-aaaa.so in a working configuation? The log shows:

Apr 14 17:15:18 ns named[29299]: mem.c:1795: INSIST(mpctx->allocated >
0) failed, back trace

The backtrace in the log does not have debug info, but the Centos abort
handler shows a bit more detail:

libns.so(ns_query_start) -> libns.so -> libns.so -> filter-aaaa.so ->
libisc.so(isc__mempool_put) -> libisc.so -> libc.so(abort)

Anything obvious that I am doing incorrectly, before I rebuild this with
debug symbols?




-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)

iEYEAREKAAYFAlyz0CQACgkQL6j7milTFsGgVQCffDMNYDku0nbB+nCRfVf53g9n
kgUAn0Mw7wlNPODkp408l2VQCeoSeN0S
=m1el
-----END PGP SIGNATURE-----



_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list

bind-users mailing list
[hidden email]
https://lists.isc.org/mailman/listinfo/bind-users
Reply | Threaded
Open this post in threaded view
|

Re: 9.14.0 filter-aaaa

Vicky Risk
Administrator
On Apr 14, 2019, at 5:35 PM, Carl Byington via bind-users <[hidden email]> wrote:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

view "normal" {
   plugin query "filter-aaaa.so" {
       filter-aaaa-on-v4 yes;
       filter-aaaa { "brokenv6"; };
   };
....

named-checkconf likes that, but named gets a segfault in filter-aaaa.so.
Anyone using filter-aaaa.so in a working configuation? The log shows:


Hi Carl,

I think I know what the problem is. We added a new ‘feature’ in BIND 9.14.0, support for plug-in modules to modify query processing. The first module we created was to support the filter-aaaa function.

As a result, you have to change the syntax for configuring this feature. This was release-noted, but I see it was not clearly stated in the release note that this is a non-backwards compatible change, and requires a configuration update.  

5106.	[experimental]	A new "plugin" mechanism has been added to allow
			extension of query processing functionality through
			the use of dynamically loadable libraries. A
			"filter-aaaa.so" plugin has been implemented,
			replacing the filter-aaaa feature that was formerly
			implemented as a native part of BIND.

			The "filter-aaaa", "filter-aaaa-on-v4" and
			"filter-aaaa-on-v6" options can no longer be
			configured using native named.conf syntax. However,
			loading the filter-aaaa.so plugin and setting its
			parameters provides identical functionality.

			Note that the plugin API is a work in progress and
			is likely to evolve as further plugins are
			implemented. [GL #15]
From the ARM:

DESCRIPTION

filter-aaaa.so is a query plugin module for named, enabling named to omit some IPv6 addresses when responding to clients.

Until BIND 9.12, this feature was implemented natively in named and enabled with the filter- aaaa ACL and the filter-aaaa-on-v4 and filter-aaaa-on-v6 options. These options are now depre- cated in named.conf, but can be passed as parameters to the filter-aaaa.so plugin, for example:

This module is intended to aid transition from IPv4 to IPv6 by withholding IPv6 addresses from DNS clients which are not connected to the IPv6 Internet, when the name being looked up has an IPv4 address available. Use of this module is not recommended unless absolutely necessary.

Note: This mechanism can erroneously cause other servers not to give AAAA records to their clients. If a recursing server with both IPv6 and IPv4 network connections queries an authori- tative server using this mechanism via IPv4, it will be denied AAAA records even if its client is using IPv6.

OPTIONS

filter-aaaa

Specifies a list of client addresses for which AAAA filtering is to be applied. The default is any.

filter-aaaa-on-v4
If set to yes, the DNS client is at an IPv4 address, in filter-aaaa, and if the response does not include DNSSEC signatures, then all AAAA records are deleted from the response. This filtering applies to all responses and not only authoritative responses.

If set to break-dnssec, then AAAA records are deleted even when DNSSEC is enabled. As suggested by the name, this causes the response to fail to verify, because the DNSSEC protocol is designed to detect deletions.

This mechanism can erroneously cause other servers not to give AAAA records to their clients. A recursing server with both IPv6 and IPv4 network connections that queries an authoritative server using this mechanism via IPv4 will be denied AAAA records even if its client is using IPv6.

filter-aaaa-on-v6
Identical to filter-aaaa-on-v4, except it filters AAAA responses to queries from IPv6 clients instead of IPv4 clients. To filter all responses, set both options to yes



Victoria Risk
Product Manager
Internet Systems Consortium






_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list

bind-users mailing list
[hidden email]
https://lists.isc.org/mailman/listinfo/bind-users
Vicky Risk
Product Manager,
Internet Systems Consortium
Reply | Threaded
Open this post in threaded view
|

Re: 9.14.0 filter-aaaa

Vicky Risk
Administrator
Sorry Carl,

I see you ARE trying to use the new syntax. I saw filter-aaaa and kind of skipped over the rest… I was so excited that finally I thought I could answer something, but, it was the *wrong* answer!

Vicky

On Apr 15, 2019, at 10:49 AM, Victoria Risk <[hidden email]> wrote:

On Apr 14, 2019, at 5:35 PM, Carl Byington via bind-users <[hidden email]> wrote:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

view "normal" {
   plugin query "filter-aaaa.so" {
       filter-aaaa-on-v4 yes;
       filter-aaaa { "brokenv6"; };
   };
....

named-checkconf likes that, but named gets a segfault in filter-aaaa.so.
Anyone using filter-aaaa.so in a working configuation? The log shows:


Hi Carl,

I think I know what the problem is. We added a new ‘feature’ in BIND 9.14.0, support for plug-in modules to modify query processing. The first module we created was to support the filter-aaaa function.

As a result, you have to change the syntax for configuring this feature. This was release-noted, but I see it was not clearly stated in the release note that this is a non-backwards compatible change, and requires a configuration update.  






_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list

bind-users mailing list
[hidden email]
https://lists.isc.org/mailman/listinfo/bind-users
Vicky Risk
Product Manager,
Internet Systems Consortium
Reply | Threaded
Open this post in threaded view
|

Re: 9.14.0 filter-aaaa

Evan Hunt
In reply to this post by Bind-Users forum mailing list
On Sun, Apr 14, 2019 at 05:35:42PM -0700, Carl Byington via bind-users wrote:

> named-checkconf likes that, but named gets a segfault in filter-aaaa.so.
> Anyone using filter-aaaa.so in a working configuation? The log shows:
>
> Apr 14 17:15:18 ns named[29299]: mem.c:1795: INSIST(mpctx->allocated >
> 0) failed, back trace
>
> The backtrace in the log does not have debug info, but the Centos abort
> handler shows a bit more detail:
>
> libns.so(ns_query_start) -> libns.so -> libns.so -> filter-aaaa.so ->
> libisc.so(isc__mempool_put) -> libisc.so -> libc.so(abort)
>
> Anything obvious that I am doing incorrectly, before I rebuild this with
> debug symbols?

No, nothing obvious.  Would you mind sending me your full named.conf? I'll
try to reproduce the problem locally.  (If you use "named-checkconf -px",
it will occlude all the key secrets.)

                                        eh
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list

bind-users mailing list
[hidden email]
https://lists.isc.org/mailman/listinfo/bind-users