From thozza@redhat.com Wed Mar 1 12:25:35 2017 X-Scanned-BY: MIMEDefang 2.68 on 10.5.11.24 CC: mbasti@redhat.com, "Petr Mensik" MIME-Version: 1.0 In-Reply-To: X-Spam-Status: No, score=-8.3 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_HI, RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,RP_MATCHES_RCVD autolearn=ham autolearn_force=no version=3.4.0 X-RT-Interface: API References: <558D66FE.8070904@redhat.com> Message-ID: <19d8805a-576e-b238-c4d3-815620ec4c21@redhat.com> content-type: text/plain; charset="utf-8" X-RT-Original-Encoding: utf-8 Received: from mx.pao1.isc.org (mx.pao1.isc.org [149.20.64.53]) by bugs.isc.org (Postfix) with ESMTP id 366A871B5A8 for ; Wed, 1 Mar 2017 12:25:35 +0000 (UTC) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx.pao1.isc.org (Postfix) with ESMTPS id 633623493BB for ; Wed, 1 Mar 2017 12:25:31 +0000 (UTC) Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 34BB868814 for ; Wed, 1 Mar 2017 12:25:32 +0000 (UTC) Received: from thozza-pc.brq.redhat.com (ovpn-204-221.brq.redhat.com [10.40.204.221]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id v21CPTEe029906 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 1 Mar 2017 07:25:30 -0500 Delivered-To: bind9-bugs@bugs.isc.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 Subject: Re: [ISC-Bugs #39893] AutoReply: nsupdate: Queries for TKEY are sent to wrong server when using GSSAPI Return-Path: X-Original-To: bind9-bugs@bugs.isc.org Date: Wed, 1 Mar 2017 13:25:27 +0100 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.38]); Wed, 01 Mar 2017 12:25:32 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on mx.pao1.isc.org To: bind9-bugs@isc.org Content-Transfer-Encoding: 7bit From: "Tomas Hozza" RT-Message-ID: Content-Length: 4323 On 04.11.2016 14:47, Tomas Hozza via RT wrote: > On 26.06.2015 16:51, BIND9 Bugs via RT wrote: > > Greetings, > > > > This message was automatically generated to acknowledge receipt of > > your recent email > > "nsupdate: Queries for TKEY are sent to wrong server when using GSSAPI", > > and to let you know that we have opened a ticket for your request > > (a summary of which appears below.) > > > > We do not need a further response from you, but if you do respond, > > please include in the Subject of your reply the ID > > '[ISC-Bugs #39893]' > > so that we can match up your reply with our trouble ticket. > > > > What Happens Next > > ================= > > > > Bug reports submitted to us in this manner are handled based on > > perceived severity in relation to other bugs. We handle reports as > > time permits so there is no guaranteed response time for these > > reports. > > > > If you feel the issue you are reporting is a security issue, please > > see http://www.isc.org/security/reporting-issues for details on how > > to report it, including the PGP key you may use. > > > > If it is of a non-security yet still urgent matter, you may reply > > to this message to add further information. > > > > > > Other Support Options > > ===================== > > > > If your organization requires more immediate attention, ISC offers > > paid support options. Please see http://www.isc.org/services/support > > for more information. > > > > If paid support is not an option, please consider making a donation > > to ISC. We don't require a donation -- we will work on your report > > just as quickly whether or not you can donate -- but we always need > > and welcome community support. See http://www.isc.org/supportisc > > > > > > Run a Supported Version > > ======================= > > > > If you are not running a supported version of BIND, please upgrade. > > Bug reports against unsupported versions of BIND are discouraged, > > as your issue may have already been addressed. > > > > You can find the latest version of BIND here: > > > > https://www.isc.org/software/bind > > > > > > For configuration help... > > ========================= > > > > Questions regarding configuration or setup of BIND are addressed on > > the bind-users list - to subscribe, visit: > > > > https://lists.isc.org/mailman/listinfo/bind-users > > > > > > Thank you, > > bind9-bugs@isc.org > > > > --------------------------------------------------------------------- > > > > Hi. > > > > While testing fix for [ISC-Bugs #39840] I found another issue in nsupdate. > > > > If using GSSAPI, then queries for TKEY are always sent to the servers > > specified in the /etc/resolv.conf instead to the master server for the > > zone. If the server is specified explicitly as 'server' option, Queries > > are sent to the correct server. > > > > The problem is that the code in GSSAPI specific paths was not modified > > to cope with changes done in upstream ticket RT#37925, especially the > > use of master_servers instead of servers. > > > > I'm attaching packet dumps for illustration what happened: > > - without fix and without explicit 'server' option > > - without fix and with explicit 'server' option > > - with fix without explicit 'server' option > > > > I'm also attaching the patch I used and tested. Although I'm not sure if > > the code in recvgss() should be modified (as done by my patch), it > > seemed reasonable. Since As I understood the code that if TKEY query to > > the first master_server failed, it should be sent to the second one, if > > there is any. Nevertheless the changes in start_gssrequest() are the key > > to fixing the issue. > > > > Regards, > > > > Hello. > > Any updates on this issue? The bug is causing issues to FreeIPA project in Fedora, which uses nsupdate. I would like to kindly ask you to review the patch I sent with the original report. If there are any changes needed for the fix to be merged, please let me know. > > Thank you. > > Regards, > Hello. Any updates on this issue? I would like to ask if there is anything blocking the merge of the patch I provided in the initial report? Thank you. Regards, -- Tomas Hozza Associate Manager, Software Engineering - EMEA ENG Mainstream RHEL PGP: 1D9F3C2D UTC+1 (CET) Red Hat Inc. http://cz.redhat.com