Re: [dns-operations] Bind 9.8.0 intermittent problem with non-recursive responses

2011-05-19 Thread Evan Hunt
> I hope to have a fix soon, before 9.8.1 ships (but after 9.8.1b1, which > is already in the pipeline). Followup: The bug was in fact found about an hour after I wrote that, and will be fixed in 9.8.1. -- Evan Hunt -- e...@isc.org Internet Systems Consortium, Inc. _

Re: [dns-operations] Bind 9.8.0 intermittent problem with non-recursive responses

2011-05-19 Thread Matthew Pounsett
On 2011-05-19, at 21:58, Michael Sinatra wrote: > If you're saying that you shouldn't *offer* recursive and authoritative > services on the same box, then I generally agree. If you're saying that you > shouldn't ever prime your cache with a zone, or have a recursive server be a > slave to any

Re: [dns-operations] Bind 9.8.0 intermittent problem with non-recursive responses

2011-05-19 Thread Mark Andrews
In the end it was a simple bug. dbversion->queryok was not being set to ISC_TRUE when it should have been (second change). Initialising dbversion->queryok to ISC_FALSE made the failure deterministic. This will be in BIND 9.8.1 final. BIND 9.8.1b1 is already cut and will need this to be applied.

Re: [dns-operations] Bind 9.8.0 intermittent problem with non-recursive responses

2011-05-19 Thread Matthew Pounsett
On 2011-05-20, at 00:35, Carlos Vicente wrote: > That's news to me. What's the failure mode? Does the server return SERVFAIL, > or does it not set the AD flag, or...? It's another undefined condition in the RFCs, and so the outcome is implementation specific. I believe in the case of BIND th

Re: [dns-operations] Bind 9.8.0 intermittent problem with non-recursive responses

2011-05-19 Thread Carlos Vicente
Hi all, > If you're saying that you shouldn't *offer* recursive and authoritative > services on the same box, then I generally agree. If you're saying that you > shouldn't ever prime your cache with a zone, or have a recursive server be a > slave to anything, then I'd say it gets kind of hairy t

Re: [dns-operations] Bind 9.8.0 intermittent problem with non-recursive responses

2011-05-19 Thread Carlos Vicente
Hi all, > If you're saying that you shouldn't *offer* recursive and authoritative > services on the same box, then I generally agree. If you're saying that you > shouldn't ever prime your cache with a zone, or have a recursive server be a > slave to anything, then I'd say it gets kind of hairy t

Re: [dns-operations] Bind 9.8.0 intermittent problem with non-recursive responses

2011-05-19 Thread Tory M Blue
On Thu, May 19, 2011 at 7:44 PM, Evan Hunt wrote: >> Odds are good this is a software bug in BIND. > > I can absolutely confirm that this is a bug in BIND 9; we're aware of > it and have been trying to reproduce it for some time.  Unfortunately > it seems to be triggered by some environmental cond

Re: [dns-operations] Bind 9.8.0 intermittent problem with non-recursive responses

2011-05-19 Thread Evan Hunt
> Odds are good this is a software bug in BIND. I can absolutely confirm that this is a bug in BIND 9; we're aware of it and have been trying to reproduce it for some time. Unfortunately it seems to be triggered by some environmental condition we haven't identified yet--the bug has never once tur

Re: [dns-operations] Bind 9.8.0 intermittent problem with non-recursive responses

2011-05-19 Thread Michael Sinatra
Hi Matt: On 05/19/11 17:08, Matthew Pounsett wrote: While it's possible you have encountered a bug with BIND, it's generally a bad idea to mix recursive and authoritative service in the same process. The RFCs that define the resolution algorithms were never written with mixed service in mind, a

Re: [dns-operations] Bind 9.8.0 intermittent problem with non-recursive responses

2011-05-19 Thread Matthew Pounsett
While it's possible you have encountered a bug with BIND, it's generally a bad idea to mix recursive and authoritative service in the same process. The RFCs that define the resolution algorithms were never written with mixed service in mind, and there are conflicts that can result in undefined,

Re: [dns-operations] Bind 9.8.0 intermittent problem with non-recursive responses

2011-05-19 Thread Carlos Vicente
Hi Patrick, This is interesting. I just realized that the problem is not exclusive of my anycast servers. I noticed that my authoritative-only servers were not returning the ADDITIONAL section either, so I restarted BIND, and they started doing so. So this does look more clearly like some kind of

Bind 9.8.0 intermittent problem with non-recursive responses

2011-05-19 Thread Carlos Vicente
Dear lists [apologies if you receive two copies of this message], I am in the process of implementing anycast recursive DNS service for our campus using a combination of servers running Bind 9.8.0 and Cisco's IP SLA feature. There are three identical Redhat servers connected to three different rou