On Thu, 20 Sep 2007 15:28:48 -0700, Stephen Manchester wrote:
> Here is the output of pmap. It's showing the problem as a series of
> 10MB allocations. I chopped out a big section that was completely
> redundant.
[...]
> 8f1cb000 4 - 8f1cb000 000:0 [ anon ]
> 8f1cc000
On Tue, 29 Jul 2008 12:49:24 +0200, Leen Besselink wrote:
[...]
> And Windows XP doesn't support DNS over IPv6, installing a local
> forwarding IPv6-enabled PowerDNS-recursor might a be solution to
> that ? Can I forward . ? I've never tried it.
>
> Hmm, maybe there is an easier way to do this ?
W
On Tue, 29 Jul 2008 23:13:07 +0200, Leen Besselink wrote:
>> Wouldn't simple UDP forwarding be sufficient in this case? (but you would
>> still need to find a program to do the UDP forwarding)
> Yes, I guess that is possible. You'd lose source port randomisation,
> all the rage these days and cachi
On Tue, 18 Nov 2008 20:48:31 +0100, bert hubert wrote:
> Download from:
> http://downloads.powerdns.com/releases/pdns-2.9.22-rc1.tar.gz
>
> http://downloads.powerdns.com/releases/deb/stable/pdns-static_2.9.22-rc1-1_i386.deb
>
> http://downloads.powerdns.com/releases/rpm/pd
Hi,
since about Friday late evening I am seeing lots of pdns errors in my syslog
like:
Not authoritative for '', sending servfail to 76.9.31.42 (recursion was
desired)
Over in comp.protocols.dns.bind there is already some discussion about these
DNS requests (which apparently use a spoofed so
On Tue, 1 Jun 2010 16:12:45 -0500, Naked Short-Selling wrote:
> I read your post regarding multithreaded epoll_wait behavior on lkml a
> couple of months ago:
> "
> http://lkml.org/lkml/2010/3/3/441
> "
My understanding is that using EPOLLET would be the right approach - and
particularly for UDP s
On Thu, 27 Jan 2011 23:37:01 +0100, bert hubert wrote:
> (the short version, there is a snapshot worth looking at, packages on
> http://powerdnssec.org/downloads - documentation on http://powerdnssec.org )
That's really excellent news - I have just migrated my 2 nameservers
to SVN revision 1928 an
On Sat, 29 Jan 2011 00:38:12 +0100, Christof Meerwald wrote:
> That's really excellent news - I have just migrated my 2 nameservers
> to SVN revision 1928 and signed one of the zones (btw, the setup is:
> master using bind backend for the zone data and gsqlite3 for the key
> data
On Sat, 29 Jan 2011 13:23:53 +0100, bert hubert wrote:
> On Sat, Jan 29, 2011 at 10:30:47AM +0100, Christof Meerwald wrote:
>> On Sat, 29 Jan 2011 00:38:12 +0100, Christof Meerwald wrote:
>> > That's really excellent news - I have just migrated my 2 nameservers
>> >
On Sat, 29 Jan 2011 15:42:56 +0100, Christof Meerwald wrote:
[...]
> ns.cmeerw.net reads the zone data for cmeerw.priv.at from the bind
> backend and has the keying information in the db:
Just noticed - does the order of the backends specified in launch=
make a difference? Just noticed that
On Sat, 29 Jan 2011 16:01:47 +0100, Christof Meerwald wrote:
> On Sat, 29 Jan 2011 15:42:56 +0100, Christof Meerwald wrote:
> [...]
>> ns.cmeerw.net reads the zone data for cmeerw.priv.at from the bind
>> backend and has the keying information in the db:
>
> Just noticed
On Sat, 29 Jan 2011 16:45:29 +0100, Christof Meerwald wrote:
> So I guess with that change it's mostly working now, except that
> ns2.cmeerw.net doesn't return a RRSIG record when requesting the DNSKEY:
Hmm, seems to be working now... Not sure what could have changed...
Chr
Hi,
I kind of expected this to happen today - the master (ns.cmeerw.net)
with the keying material has now updated the RRSIG records, but the
slave (ns2.cmeerw.net, no keying material) still returns the old RRSIG
records:
; <<>> DiG 9.7.1-P2 <<>> +dnssec -t soa cmeerw.priv.at @ns.cmeerw.net
;; ANS
On Thu, 3 Feb 2011 10:28:23 +0100, bert hubert wrote:
[...]
> Ideas?
>
> I prefer a solution where we don't actually increment the serial in the
> database but overlay it with something that autoincrements ('weeks since
> january first 2011').
I actually like that idea - guess that would work for
Hi,
I just noticed that one of the slave DNS servers (running Microsoft
DNS) is now unable to do a successful AXFR from my PowerDNS server
(running svn rev. 1991). This is for a non DNSSEC zone and the AXFR
works fine (with the same zone) when using pdns 2.9.22 on my side. It
appears to be specifi
On Mon, 7 Feb 2011 17:17:52 +0100, bert hubert wrote:
> On Mon, Feb 07, 2011 at 02:39:56PM +0100, bert.hub...@netherlabs.nl wrote:
>> Thanks for reporting, we are on the case! The issue has been confirmed.
> This has been fixed in revision 1992. Can you confirm?
Doesn't seem to fix it for me (Micr
On Mon, Feb 07, 2011 at 08:40:56PM +0100, Christof Meerwald wrote:
> On Mon, 7 Feb 2011 17:17:52 +0100, bert hubert wrote:
> > On Mon, Feb 07, 2011 at 02:39:56PM +0100, bert.hub...@netherlabs.nl wrote:
> >> Thanks for reporting, we are on the case! The issue has been confirmed.
On Tue, Feb 08, 2011 at 08:54:05AM +0100, bert hubert wrote:
> Our EDNS-in-AXFR has been brought in line with RFC 5936 now. I hope this
> solves your problem!
I have essentially patched my pdns yesterday which fixed the problem.
> See http://wiki.powerdns.com/trac/changeset/1994 - new packages ar
On Tue, 22 Mar 2011 21:38:30 +0100, bert hubert wrote:
> The big 3.0 release is coming real close, and it is going to be a big one.
> For the 'work in progress' release notes, please see
> http://doc.powerdns.com/changelog.html#changelog-auth-3-0
Just wanted to check what the status is on having a
On Sun, Mar 27, 2011 at 10:38:32PM +0200, bert hubert wrote:
> You can set SOA-EDIT to either 'INCEPTION', in which case the SOA serial
> number will be replaced by MMDD01 of the currently issued RRSIG
> inception, the one that rolls over each Thursday at midnight GMT.
I am not too sure how us
On Thu, 12 May 2011 17:30:36 +0200, fredrik danerklint wrote:
> Not yet since it only can handle the "minimal" (ie: no slave, master or
> dnssec) or would you like to have this at this stage with just the bare
> "minimal" ? If so, no problem. I do need some help to be able to understand
> what c
On Wed, 08 Jun 2011 18:21:14 +1200, Craig Whitmore wrote:
[...]
> Can someone help why the slave is failing=8A
I think one of the DNSSEC records is being truncated on the slave as
it exceeds 256 bytes - you might need to update the database schema on
the slave to allow for longer records.
> I can
Hi,
just tried adding some TSIG stuff for AXFRs to my PowerDNS
configuration and now my slave PowerDNS keeps saying (every hour):
Domain cmeerw.priv.at is fresh, but RRSIGS differ, so DNSSEC stale
It looks like when using TSIG PowerDNS doesn't return any RRSIG
records for a SOA request. This the
Hi,
I think I have found another problem related to RRSIG matching - this
time I am trying to use PowerDNS as a slave for a bind master. My
PowerDNS always thinks that the RRSIGs don't match.
My suspicion is that PowerDNS doesn't just use the RRSIG for the SOA
record in the DNS response, but look
On Wed, 8 Jun 2011 23:28:11 +0200, Christof Meerwald wrote:
> It looks like when using TSIG PowerDNS doesn't return any RRSIG
> records for a SOA request. This then results in the RRSIG mismatch
> message.
Ok, I have done some debugging now and this is why:
PowerDNS expects the OP
On Thu, 09 Jun 2011 11:54:53 +1200, Craig Whitmore wrote:
> Is there anyway to make presigned-zones on slaves the default.
It shouldn't be too difficult to detect a DNSSEC zone during the zone
transfer and set the presigned flag (and the NSEC3PARAM) for the
zone...
Christof
--
http://cmeerw.o
On Fri, 10 Jun 2011 23:12:36 +0200, Christof Meerwald wrote:
> On Thu, 09 Jun 2011 11:54:53 +1200, Craig Whitmore wrote:
>> Is there anyway to make presigned-zones on slaves the default.
> It shouldn't be too difficult to detect a DNSSEC zone during the zone
> transfer and se
On Sat, 11 Jun 2011 22:11:57 +1200, Craig Whitmore wrote:
[...]
> And testing if everything worked out.. Except it sets the options
> differently that if I typed "pdnssec set-nsec3 spam.co.nz" I have no idea
> what the difference is but it still passes the dig tests I do...
I have to say that I am
On Sat, 11 Jun 2011 15:16:14 +0200, Christof Meerwald wrote:
> On Sat, 11 Jun 2011 22:11:57 +1200, Craig Whitmore wrote:
> [...]
>> And testing if everything worked out.. Except it sets the options
>> differently that if I typed "pdnssec set-nsec3 spam.co.nz" I have no
On Sat, 11 Jun 2011 22:11:57 +1200, Craig Whitmore wrote:
> Ok.. Can similar be done with TSIGS . As domains are not transferred
> securely without TSIG (as far as I know) I have to enter the TSIG stuff in
> after it has transferred which kind of defeats the purpose of unattended
> slaves .
But yo
On Sun, 12 Jun 2011 10:23:15 +1200, Craig Whitmore wrote:
>>But you should be able to add the TSIG stuff just after creating the
>>domain entry (and before it gets transferred) - you might even be able
>>to use a database trigger to do it...
> Yes on the master and that¹s fine.. What about the slav
Hi,
guess I have found another bug - this time related to signing of the
SOA record when using SOA-EDIT.
In packethandler.cc the SOA record is first signed and then edited
according to the SOA-EDIT policy - this order needs to be changed to
ensure that the correct SOA record is signed.
Christof
On Sat, 11 Jun 2011 19:00:55 +0200, Christof Meerwald wrote:
> I have updated my patch (http://wiki.powerdns.com/trac/ticket/369) to
> also look at the NSEC3 records for the opt-out flag - this should at
> least work with a PowerDNS master, but will not work if the flags do
> differ
On Wed, 21 Sep 2011 01:51:28 +0200, Stefan Schmidt wrote:
> On Tue, Sep 20, 2011 at 11:49 AM, Peter Gervai
> wrote:
>> which reminds me: is there a way to wipe the packet cache? rec_control
>> wipe-cache simply doesn't.
> It does if you specify something that it would wipe off the cache.
I don't s
On Thu, 22 Sep 2011 07:36:42 +0300, Aki Tuomi wrote:
> Please see http://wiki.powerdns.com/trac/ticket/333
> for wiping the packet cache.
But as far as I can see that patch will only wipe a single (random)
packet cache (and not the packet cache for each thread)?
Christof
--
http://cmeerw.org
On Thu, 22 Sep 2011 09:20:46 +0300, Aki Tuomi wrote:
>> But as far as I can see that patch will only wipe a single (random)
>> packet cache (and not the packet cache for each thread)?
> Well, actually it wipes a name from packet cache. Not just random cache.
Sorry, I think I misread the patch - I
On Fri, 28 Oct 2011 18:15:28 +0200, Thomas Mieslinger wrote:
> are IPv6 Addresses allowed in the domain tables master column? It could
> be interessting to allow hidden primaries to be v6 only, so that they do
> not consume a v4 address.
Yes, works fine (with PDNS 3.0).
Christof
--
http://c
On Sat, 29 Oct 2011 08:22:50 +0200, Thomas Mieslinger wrote:
> Am 28.10.2011 20:35, schrieb Christof Meerwald:
>> On Fri, 28 Oct 2011 18:15:28 +0200, Thomas Mieslinger wrote:
>>> are IPv6 Addresses allowed in the domain tables master column? It could
>>> be interesstin
Hi,
[ moving to pdns-users mailing list ]
On Wed, May 02, 2012 at 08:53:48PM +0200, Christof Meerwald wrote:
> After migrating the DNSSEC keys to a separate db for the bind backend,
> it now works fine with 3.1-rc3.
Actually, no - that doesn't fully work either.
After removing the k
On Wed, 2 May 2012 21:23:21 +0200, Christof Meerwald wrote:
> BTW, I can't remove the gsqlite3 backend as I am using that for slave
> zones - only the primary zones are using the bind backend.
>
> I am currently using:
>
> launch=gsqlite3,bind
>
> Swapping the orde
On Thu, 3 May 2012 09:07:42 +0200, Peter van Dijk wrote:
[...]
> Fixing this involves touching all DNSSEC-supporting modules and changing some
> interfaces.
> Therefor, we cannot do this for the 3.1 release.
>
> 3.1 will be released with a big warning about this specific setup; we intend
> to do
On Sat, 7 Jul 2012 19:36:10 +0200, bert hubert wrote:
> On Fri, Jul 06, 2012 at 11:21:26AM +0200, Peter Gervai wrote:
>> I welcome this message but reminds me of mentioning that if there's a
>> gathered wisdom about common pitfalls and usual possible improvements
>> it may be useful to share these
On Sun, 8 Jul 2012 21:21:59 +0300, Aki Tuomi wrote:
> On Sun, Jul 08, 2012 at 09:08:45PM +0300, Aki Tuomi wrote:
>> On Sun, Jul 08, 2012 at 07:03:08PM +0200, Peter van Dijk wrote:
>> > Aki Tuomi recently submitted a patch that presumably removes that limit=
> ation - at least for any combination of
On Mon, 20 Aug 2012 21:31:44 +0200, Peter van Dijk wrote:
> On Aug 20, 2012, at 21:02 , Rickard Dahlstrand wrote:
>> In file included from dnsreplay.cc:44:
>> dnspcap.hh:15:26: error: net/if_ether.h: No such file or directory
>> *** Error code 1
> As for dnsreplay, I would suggest:
> 1. checking wh
Hi,
just noticed something strange when trying to resolve powerdns.com via
Google DNS, e.g.
$ dig +dnssec -t ns powerdns.com @8.8.8.8
; <<>> DiG 9.8.1-P1 <<>> +dnssec -t ns powerdns.com @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13535
;; f
On Wed, 25 Sep 2013 10:49:39 +0200, Fredrik Roubert wrote:
> My ISP is running a slave DNS service, using PowerDNS 3.0 as this is the
> version included in Ubuntu 12.04 LTS. I've already read this post, about
> DNSSEC in 3.0 being "explicitly deprecated":
>
> http://mailman.powerdns.com/piper
On Sun, 01 Dec 2013 18:46:10 +0100, Beagle wrote:
> I'd like to try and use PowerDNS for the first time in my life, on a
> BeagleBone Black [1] , which has a ARM CPU:
[...]
> Please advise.. is downloading/compiling the/from source the best way to
> go for me on this platform?
There is a package i
Hi,
I just noticed that IXFRs appear to be broken when using EDIT-SOA in
3.4.0 - it looks like "rfc1982LessThan(serial, sd.serial)" compares
the un-edited SOA from the zone and therefore doesn't send any data
back to the client.
Another thing I noticed is that in bind-hybrid mode the
ALLOW-AXFR-F
On Thu, Oct 16, 2014 at 10:42:34AM +0200, Christof Meerwald wrote:
> I just noticed that IXFRs appear to be broken when using EDIT-SOA in
> 3.4.0 - it looks like "rfc1982LessThan(serial, sd.serial)" compares
> the un-edited SOA from the zone and therefore doesn't send any d
On Thu, Oct 16, 2014 at 10:42:34AM +0200, Christof Meerwald wrote:
> Another thing I noticed is that in bind-hybrid mode the
> ALLOW-AXFR-FROM for a zone handled by the bind backend doesn't appear
> to be read from the database (because I think it only tries to get
> that informat
On Thu, 30 Oct 2014 14:26:33 +0100, Peter van Dijk wrote:
> PowerDNS Authoritative Server 3.4.1 is now available!
Bit of a shame that this doesn't seem to address
http://mailman.powerdns.com/pipermail/pdns-users/2014-October/010950.html
Christof
--
http://cmeerw.org
Hi,
On Wed, 17 Dec 2014 03:54:24 -0300, Ciro Iriarte wrote:
[...]
> You need eigen3-devel, gcc-c++, git and boost-devel. At least that's
> where I'm stuck:
>
> [root@admin metronome-master]# make
> fatal: Not a git repository (or any of the parent directories): .git
> g++ -Wall -O3 -ggdb -I. -I ya
Hi,
is the "delegation-only" option still supposed to be working with
recursor 4.0.x? I have just built 4.0.1 and had problems with
resolving any .com or .net domains until I found that I still had
"delegation-only" set for .com and .net in the configuration file.
Is this option broken in 4.0.1?
Hi,
so the intention is to allow AXFRs from a set of static IPs and
additionally from any IP with a valid TSIG signature.
This seemed to work quite fine with 3.x when setting TSIG-ALLOW-AXFR
on the master for the domains affected (and no TSIG setting on the
slave as the slave would have a static
On Mon, 29 Aug 2016 17:22:38 +0300, Aki Tuomi wrote:
> On Mon, Aug 29, 2016 at 01:18:05PM +0200, Christof Meerwald wrote:
>> so the intention is to allow AXFRs from a set of static IPs and
>> additionally from any IP with a valid TSIG signature.
[...]
> What is the point of usin
On Tue, 20 Sep 2016 19:26:01 +0200, Yves Goergen wrote:
> Thanks for the info. Strange that Ubuntu has decided to do such nonsense
> for a stable distribution. Good to check what you'll get before you get it.
The PowerDNS packages you see in Ubuntu are in "universe" which means
they are essential
Hi,
just upgraded to PowerDNS 4.5.1 today and noticed that zones from the
bind backend stopped working (getting REFUSED response).
Essentially, I am using
bind-config=/etc/named.conf
which contains the list of zones to load on start up.
When adding "zone-cache-refresh-interval=0" to the confi
Hi,
it seems to be impossible to return a "TXT" record that only contains
digits from the lua backend (something like "1234").
Any attempt results in "boost::bad_get: failed value get using
boost::get".
I guess this is a side-effect of how lua_isnumber is specified:
"Returns 1 if the value at th
On Fri, 30 Jul 2021 15:48:40 +0200, Peter van Dijk via Pdns-users wrote:
> Hello Christof,
>
> On Wed, 2021-07-28 at 22:49 +0200, Christof Meerwald via Pdns-users
> wrote:
>> it seems to be impossible to return a "TXT" record that only contains
>> digits from the
On Fri, 30 Jul 2021 16:32:06 +0200, Peter van Dijk via Pdns-users wrote:
> Hello Christof,
>
> On Tue, 2021-07-27 at 19:21 +0200, Christof Meerwald via Pdns-users
> wrote:
>> After adding a zone with
>>
>> pdns bind-add-zone example.com /etc/dns/example.com.dns
60 matches
Mail list logo
