BIND issueshttps://gitlab.isc.org/isc-projects/bind9/-/issues2022-07-04T16:27:52Zhttps://gitlab.isc.org/isc-projects/bind9/-/issues/3435Develop doc helper for upgrades across many versions2022-07-04T16:27:52ZPetr Špačekpspacek@isc.orgDevelop doc helper for upgrades across many versions(This request describes a pipe dream. Of course there are various intermediate levels which are also useful even without full coverage.)
### Description
Use-case: People upgrading from arbitrarily old version want to know what changed:...(This request describes a pipe dream. Of course there are various intermediate levels which are also useful even without full coverage.)
### Description
Use-case: People upgrading from arbitrarily old version want to know what changed:
- Configuration grammar
- Defaults
- Behavior
We have people upgrading from _ancient_ versions, and going through all the release notes is pain for everyone involved, especially if something changed repeated in meanwhile.
### Request
Ultimately, an ability to "diff" grammar, defaults, and preferably also notes about changes between versions (= unicorns and rainbow).
To do that, we need:
- [X] programmatic access to grammar - available in doc/misc/parsegrammar.py
- [ ] programmatic access to defaults - parser producing machine-readable output is missing
- [ ] rst directive `.. versionchanged:: versionnumber` in the ARM describing when we changed behavior and how ([Sphinx docs](https://www.sphinx-doc.org/en/master/usage/restructuredtext/directives.html#directive-versionchanged)
With that in place we should be able to pick two versions and generate "diff" in terms of added/removed/deprecated configuration statements, changed defaults, and notes pointing to feature changes.
### Links / referencesNot plannedhttps://gitlab.isc.org/isc-projects/bind9/-/issues/3434Define grammar for duration (and other elements) in the ARM2022-07-30T13:31:23ZPetr Špačekpspacek@isc.orgDefine grammar for duration (and other elements) in the ARMThe ARM does not define all grammar elements used through the text. I think the most complicated one which is missing is duration (TTL + ISO 8601 styles). ACL is defined in its own chapter so that one is somehow covered.
Terms missing i...The ARM does not define all grammar elements used through the text. I think the most complicated one which is missing is duration (TTL + ISO 8601 styles). ACL is defined in its own chapter so that one is somehow covered.
Terms missing in the ARM at the moment (commit 788aa4b12f0af3dae08c07dc79a6a13d2d768806):
```
$ diff -U0 <(grep --no-filename --only '<[^>]*>' doc/misc/options doc/misc/*.zoneopt | sort -u | tr -d '<>') <(grep '^ ``[^`]*``$' doc/arm/reference.rst | tr -d ' `' | sort -u) | grep '^-'
-address_match_element
-class
-duration
-duration_or_unlimited
-log_severity
-quoted_string
-rrtypelist
-string
-syslog_facility
-unspecified-text
```
Elements used by grammar:
```
$ grep --no-filename --only '<[^>]*>' doc/misc/options doc/misc/*.zoneopt | sort -u | tr -d '<>'
address_match_element
boolean
class
duration
duration_or_unlimited
fixedpoint
integer
ipv4_address
ipv6_address
log_severity
netprefix
percentage
portrange
quoted_string
remote-servers
rrtypelist
server_key
size
sizeval
string
syslog_facility
unspecified-text
```
Terms defined in the ARM (roughly!):
```
$ grep '^ ``[^`]*``$' doc/arm/reference.rst | tr -d ' `' | sort -u
acl_name
address_match_list
any
boolean
domain_name
dscp
fixedpoint
integer
ip_address
ipv4_address
ipv6_address
localhost
localnets
masters
netprefix
none
percentage
port
portrange
remote-servers
server_key
size
sizeval
tls_id
```https://gitlab.isc.org/isc-projects/bind9/-/issues/3432module_postgres support2022-07-01T06:52:04ZCaglar Ulkudernermodule_postgres support### Description
Since old style dlz drivers have been removed, module_postgres is not supported on new bind.
### Request
Please include module_postgres support to enable multi cpu on dlz query.
### Links / references### Description
Since old style dlz drivers have been removed, module_postgres is not supported on new bind.
### Request
Please include module_postgres support to enable multi cpu on dlz query.
### Links / referencesNot plannedhttps://gitlab.isc.org/isc-projects/bind9/-/issues/3431auth/DNSSEC: RRSIGs not removed when node becomes delegation point2022-06-30T23:27:56ZLibor Peltanauth/DNSSEC: RRSIGs not removed when node becomes delegation point### Summary
Bind operates as primary authoritative with DNSSEC signing enabled. A node (say `xyz.xyz.hahnekedar.`) already exists and has A+AAAA records signed. An incremental update adds a NS record to the node, making it a delegation ...### Summary
Bind operates as primary authoritative with DNSSEC signing enabled. A node (say `xyz.xyz.hahnekedar.`) already exists and has A+AAAA records signed. An incremental update adds a NS record to the node, making it a delegation point, making the previously authoritative A+AAAA records non-authoritative in this zone. As a result, their signatures should be removed.
### BIND version used
9.18.4 (also 9.18.1 and potentially others)
```
BIND 9.18.4-1+ubuntu20.04.1+isc+1-Ubuntu (Stable Release) <id:>
running on Linux x86_64 5.4.0-113-generic #127-Ubuntu SMP Wed May 18 14:30:56 UTC 2022
built by make with '--build=x86_64-linux-gnu' '--prefix=/usr' '--includedir=${prefix}/include' '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info' '--sysconfdir=/etc' '--localstatedir=/var' '--disable-silent-rules' '--libdir=${prefix}/lib/x86_64-linux-gnu' '--libexecdir=${prefix}/lib/x86_64-linux-gnu' '--disable-maintainer-mode' '--disable-dependency-tracking' '--libdir=/usr/lib/x86_64-linux-gnu' '--sysconfdir=/etc/bind' '--with-python=python3' '--localstatedir=/' '--enable-threads' '--enable-largefile' '--with-libtool' '--enable-shared' '--disable-static' '--with-gost=no' '--with-openssl=/usr' '--with-gssapi=yes' '--with-libidn2' '--with-json-c' '--with-lmdb=/usr' '--with-gnu-ld' '--with-maxminddb' '--with-atf=no' '--enable-ipv6' '--enable-rrl' '--enable-filter-aaaa' '--disable-native-pkcs11' '--enable-dnstap' 'build_alias=x86_64-linux-gnu' 'CFLAGS=-g -O2 -fdebug-prefix-map=/build/bind9-chX9Xr/bind9-9.18.4=. -fstack-protector-strong -Wformat -Werror=format-security -fno-strict-aliasing -fno-delete-null-pointer-checks -DNO_VERSION_DATE -DDIG_SIGCHASE' 'LDFLAGS=-Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now' 'CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2'
compiled by GCC 9.4.0
compiled with OpenSSL version: OpenSSL 1.1.1f 31 Mar 2020
linked to OpenSSL version: OpenSSL 1.1.1f 31 Mar 2020
compiled with libuv version: 1.44.1
linked to libuv version: 1.44.1
compiled with libnghttp2 version: 1.40.0
linked to libnghttp2 version: 1.40.0
compiled with libxml2 version: 2.9.10
linked to libxml2 version: 20910
compiled with json-c version: 0.13.1
linked to json-c version: 0.13.1
compiled with zlib version: 1.2.11
linked to zlib version: 1.2.11
linked to maxminddb version: 1.4.2
compiled with protobuf-c version: 1.3.3
linked to protobuf-c version: 1.3.3
threads support is enabled
default paths:
named configuration: /etc/bind/named.conf
rndc configuration: /etc/bind/rndc.conf
DNSSEC root key: /etc/bind/bind.keys
nsupdate session key: //run/named/session.key
named PID file: //run/named/named.pid
named lock file: //run/named/named.lock
geoip-directory: /usr/share/GeoIP
```
### Steps to reproduce
See Summary.
### What is the current *bug* behavior?
The RRSIGs of the previously authoritative records are not removed from the zone.
### What is the expected *correct* behavior?
The RRSIGs should be no longer present in the zone.
### Relevant configuration files
```
options {
directory "/tmp/knottest-1656601404-kbfbxc3h/dnssec/validate_bind/bind1";
key-directory "/tmp/knottest-1656601404-kbfbxc3h/dnssec/validate_bind/bind1";
managed-keys-directory "/tmp/knottest-1656601404-kbfbxc3h/dnssec/validate_bind/bind1";
session-keyfile "/tmp/knottest-1656601404-kbfbxc3h/dnssec/validate_bind/bind1/session.key";
pid-file "/tmp/knottest-1656601404-kbfbxc3h/dnssec/validate_bind/bind1/bind.pid";
listen-on port 21461 { 127.0.0.1; };
listen-on-v6 { };
auth-nxdomain no;
recursion no;
masterfile-format text;
max-refresh-time 2;
max-retry-time 2;
transfers-in 30;
transfers-out 30;
minimal-responses true;
notify-delay 0;
notify-rate 1000;
max-journal-size unlimited;
max-ixfr-ratio unlimited;
startup-notify-rate 1000;
serial-query-rate 1000;
};
key "vsIj.JK2zpN69I9lrZ3M2wBOek8EjENtyvimIH0O8HpstVdWCI8yh96fLVGK88" {
algorithm hmac-md5;
secret "KkTQCVgZ54xSOtXoR0TwfA==";
};
controls {
inet 127.0.0.1 port 21462 allow { 127.0.0.1; } keys { vsIj.JK2zpN69I9lrZ3M2wBOek8EjENtyvimIH0O8HpstVdWCI8yh96fLVGK88; };
};
key "K8VMS.r8vKnF4I" {
# test
algorithm hmac-sha384;
secret "oIXitWx9sj66cCS4LzEjBBzjEQ7PxsR2WQVYbYSrFZIfdZ+CwpJTpo/qBjVTFCgh";
};
key "C8s0rGMAIWmKXmlE9g0Qc2YpKZMKeBqOxM6bzpqvTM50sAN7tPoNSKG6zkyPy.RRnMzzgsXaXv9pMsfpmdky.A61mVO33Stxh6PtW8Eenpdknt2.qhC6akpkb8aGw59RKAyIai60U4wvRWzNM57XMpcYdnPF.jnA3Jbq7QyTX64H924qywefBjXzhriUI7s8fLIYUrF4OtCA4I5UagQ" {
# local
algorithm hmac-sha256;
secret "ihC0Exd7Qq0q+s/mYsfVLq8KlBg1odYtuqsol5RB0d0=";
};
key "S8oUeWsERvzj4f6SlQu3aAucUhp.X5yMyeE287KUpVbXhl3ikdCIkQ59SFKTBS6yxd7qPEkaVIOA8PS4.sTIX7xW1qtyqxBpKqdSKP4hy5V2.Dub0zm5nVloE1KQrMSagYqJAKcW7gSu24U.gQuF3LQERY6cdRS4aEvEW101jPsBU1oqdMTsgEssVwIyE2445UEgV0vj8nw77J" {
# knot1
algorithm hmac-sha256;
secret "PCVor52MeoxlZ5nn3rp4MXqLXsPGft5SW0j4h2j55AE=";
};
# more configured zone ommited
zone "hahnekedar." {
file "/tmp/knottest-1656601404-kbfbxc3h/dnssec/validate_bind/bind1/master/hahnekedar.rndzone";
check-names warn;
type master;
notify explicit;
check-integrity no;
ixfr-from-differences yes;
also-notify { 127.0.0.1 port 21463 key C8s0rGMAIWmKXmlE9g0Qc2YpKZMKeBqOxM6bzpqvTM50sAN7tPoNSKG6zkyPy.RRnMzzgsXaXv9pMsfpmdky.A61mVO33Stxh6PtW8Eenpdknt2.qhC6akpkb8aGw59RKAyIai60U4wvRWzNM57XMpcYdnPF.jnA3Jbq7QyTX64H924qywefBjXzhriUI7s8fLIYUrF4OtCA4I5UagQ; };
allow-update { key K8VMS.r8vKnF4I; };
allow-transfer { key K8VMS.r8vKnF4I; key S8oUeWsERvzj4f6SlQu3aAucUhp.X5yMyeE287KUpVbXhl3ikdCIkQ59SFKTBS6yxd7qPEkaVIOA8PS4.sTIX7xW1qtyqxBpKqdSKP4hy5V2.Dub0zm5nVloE1KQrMSagYqJAKcW7gSu24U.gQuF3LQERY6cdRS4aEvEW101jPsBU1oqdMTsgEssVwIyE2445UEgV0vj8nw77J; };
inline-signing yes;
auto-dnssec maintain;
key-directory "/tmp/knottest-1656601404-kbfbxc3h/dnssec/validate_bind/bind1/keys";
};
```
### Relevant logs and/or screenshots
The issue is easily visible by `named-journalprint /tmp/knottest-1656601404-kbfbxc3h/dnssec/validate_bind/bind1/master/hahnekedar.rndzone.signed.jnl`
Please look for any changes to the node `xyz.xyz.hahnekedar.`. With serial `345896694`, it is interoduced first having an A record, and it becomes a RRSIG and NSEC+RRSIG appropriately. With serial `345896695` it becomes an AAAA record as well, and RRSIGs and NSECs are adjusted appropriately. With serial `345896696` it becomes a NS record as well, making it a delegation point. The RRSIGs for A and AAAA should disappear, but they don't.
```
add hahnekedar. 2648 IN SOA ns.hahnekedar. username.hahnekedar. 345896694 3600 1200 2419200 2648
add xyz.ns2.hahnekedar. 0 IN A 180.47.165.192
add xyz.xyz.hahnekedar. 0 IN A 56.101.241.32
add xyz.a7a.hahnekedar. 0 IN AAAA fd9c:20c0:91fc:cb36:2e9f:23c9:369e:1bfc
add xyz.bl7b907b61.hahnekedar. 0 IN AAAA fd9c:20c0:91fc:cb36:e87c:1f6b:3b46:cf28
add xyz.pub2a0.hahnekedar. 0 IN AAAA fd9c:20c0:91fc:cb36:2e76:b085:aeda:bdcb
add xyz._sip._udp.671A1.hahnekedar. 0 IN SRV 23 5 49681 intervention.hahnekedar.
add hahnekedar. 2648 IN RRSIG SOA 8 1 2648 20220730150351 20220630140351 54646 hahnekedar. IahqYdkP/6OFhyXEKWB13M2eCgMPWrSLonWVYIWE5GeWJuV2wKFp2xYd WbduWLj9jlchQbpCb1WvZZUiNdZLJqvpCx4YkWt0mFqW5PZyDq7Rz1VM j53d6JkpKlKw8gSgt0y9RoMJKXGaz4IpvzMBDulAr88uhU5vy4XLn/uD BfQ=
add xyz._sip._udp.671A1.hahnekedar. 0 IN RRSIG SRV 8 5 0 20220718231722 20220630140351 54646 hahnekedar. tXIeLqk3MXTbBAVk13y9PtO6u/oQunXUY40zrZLyhiqEbs3UtpejFRJq tLELYr2+7eCEYeFBEqdjkgzyahDuNKJwtICP6TFRlF9zXKacHJ+vQYm4 AUv466DMg3fficEj2VKr95aQA6v1ZoGPtth5AyY/NYvQ1g3wfKvG536o ZXM=
add xyz.a7a.hahnekedar. 0 IN RRSIG AAAA 8 3 0 20220718231722 20220630140351 54646 hahnekedar. hxkD0n2C+aHZnl5Ds5kRVO10pN5rY3VuKu6UqiRKvbbLG4x8uCp5vMpq xraRSYZpiXlRUtz6tMtLHfw2c/NAbhuVSZwtxsf1zk0kShqZVbJgUgdr 4SA4zPyow99SVkiEj9udter0HJmpnmUgWdwbExCaoLgMBqhrSP/Sb7fA 8oY=
add xyz.bl7b907b61.hahnekedar. 0 IN RRSIG AAAA 8 3 0 20220718231722 20220630140351 54646 hahnekedar. eAXsvnXqYd+AaS7KyiubuKuetx6fAOrqQtkQmIl41OH8Cop1Ui24u6OD pdT3Ii75CFJz3IFtHdScdlEAvhFkO9Jlpk5BAat4aooUZDXMRfvUNCoB K748aL2tSpEOkRCD84g/ETsnTA4iW+dFAuDBlgYOwgQAaMFvduoU4prV jqk=
add xyz.ns2.hahnekedar. 0 IN RRSIG A 8 3 0 20220718231722 20220630140351 54646 hahnekedar. dgrlg6VprM78tL3KQXHpZHWyMeRCEB2Onp9t00atg16LEt5b9XdI4ona WODfHCRLP9JUEZFd/Sa1EzI9yRrHQz/sLNsFwHkJ4aydm9yNW5gSmNsC Jn0zkiCBS1hifGnwcb7URAgN0M84h68TCD0Q808RrzpRbxDneceOCR85 N1A=
add xyz.pub2a0.hahnekedar. 0 IN RRSIG AAAA 8 3 0 20220718231722 20220630140351 54646 hahnekedar. N/gC4r/QlMfPBguDeMTc2VPmuC8vQom6XLAnkiUNZHCfAVwNSfSZwXdT 5SiB5p2Ys8m/u3KUGufEX7mACz0naQ0zbvwDr5vD+bUc7TjksmBrARoC RUzl3830KnulI/BwoLUh70g3pYuKzIgFTjOwx1i79wUCfZfimqJ2V8Av jK0=
add xyz.xyz.hahnekedar. 0 IN RRSIG A 8 3 0 20220718231722 20220630140351 54646 hahnekedar. W5ifYcm1UHBwx5j6FX0o5ms/1lmQX81IOA31KbIS4kKSFJ6X7nm3Fb7z Q4B7qZAmH6P631HouaUNyJHIZEt2F+ZOhCN3Edp3gU6xDVDtLrS1/PUs /bhAUD+oIMWNd/fEqMiU2SKKYrDpkj1ph336wWiI4yci6/emZ4tsmXyE ztQ=
add 0acC77eFAbbdc268.hahnekedar. 2648 IN RRSIG NSEC 8 2 2648 20220718231722 20220630140351 54646 hahnekedar. kQXr8PiNDG9IwnJG+d17dlHpJoZSMFO6AqJyS5R+9FuUgk8NX+tFqkOE 39lfDF8+xfavsiuR7luOYY9Y5fOM9/2qkCWP6dvdXw3HNrqD/aRrMW1K PERGgrqqdzAGaiGlNF9Kpc8erjAp1to+lbwVlok7n/4pxBxNUWlJmrXj F/E=
add xyz.2Ce98A477.hahnekedar. 2648 IN RRSIG NSEC 8 3 2648 20220718231722 20220630140351 54646 hahnekedar. C/akuQjWbn2GxlV0jbXLSJiDoTZoZMnuy+i7VGtuFjnjXogl097tjAME XUwhMOiqTDOcwJpcF4vdhQe+bWE+nXulZcrPXXtxP/DpuBdTQLrN8Z9k bCsqSW35Zyxvz1SLhah5xMw6iKR2l+cYYwyl4dqm7KuxEYgJF7riNp2t AlA=
add _sip._udp.671A1.hahnekedar. 2648 IN RRSIG NSEC 8 4 2648 20220718231722 20220630140351 54646 hahnekedar. ZUpBFwJdsbBf9QESGqLvSGpS0RpUnztyHsWpWlu2C7iZmoAjbwqqXERu mTJsxSPMfb17EaSBLhDF9FoyWH6ko0j5Jr2+Vd1a9M1EYGzKZh+h7Ook nPJp9Y8FfuBbURyKuQUUK20zoVSEaXeUcxISXS2k7b0InKdYlqz5uhsx 4M8=
add xyz._sip._udp.671A1.hahnekedar. 2648 IN RRSIG NSEC 8 5 2648 20220718231722 20220630140351 54646 hahnekedar. LYnDH3YWcuLN3l6Ew39HvjX4AEr4zSeP3kwxbwShcEWP0w/ofNH85kMW lAf02Qh45yxIOaOS9GpEeaVx6F8F+qpGnXbkzFCmAlIAZeZ6YG6EXxmt B4sFTYdKR2VwcqgMhAA8uaShZO0HwQwC7wjkaRG+GVdmKW/ZnRCi9zmI EeU=
add a7a.hahnekedar. 2648 IN RRSIG NSEC 8 2 2648 20220718231722 20220630140351 54646 hahnekedar. o4hzq3sirzZBjygVzAghzfOsgB5Cl0ty3d0Ecm8saylbUOKF39ZwDv94 +hSRjrA5Iz2ZgSNrUsHKNitRLCfrw9ChYVxEtlVaKVEw8DxmjfcirqWP nGnWTrIOh7g+F1R1RQmPdCsWNmT4HlYTMCk5iifxizUYE8RkEin9tR0q 37A=
add xyz.a7a.hahnekedar. 2648 IN RRSIG NSEC 8 3 2648 20220718231722 20220630140351 54646 hahnekedar. lTF4MPwG/vrRk+JT152fckLXUgW3LwcxnvThyMnGvY6KL//7nkHVlIFK JE9leplUDgoLI9Ps1l67Emmm0PVuur5mbfLMjP145S5isPM4LGNlNdnA Y4rOQztcvaPYSx0+IScvNJ1BRQM5VJ2S7/ngZG7aHEYmuU5Ql66RBwvu KMo=
add bl7b907b61.hahnekedar. 2648 IN RRSIG NSEC 8 2 2648 20220718231722 20220630140351 54646 hahnekedar. nAs4KftHJJ/vY7xpC+248ZXWn8l9f/hHzf53c7iq5RWvMkKkdW/JDFHh UurQpkcRCstpuoWqmSe5Oxrrt5xpVxk+Z+mEk1NX0aBgBQ1KJSeXuSL1 MHk5Uzsx1or4+Gk/XroIQkAzqjq7bPxuSsChObFHxWO5+Oeklkkgv+Le YcQ=
add xyz.bl7b907b61.hahnekedar. 2648 IN RRSIG NSEC 8 3 2648 20220718231722 20220630140351 54646 hahnekedar. cFmRZ1JTEwilLAhUzxUbHWkHxKbuaGIuHp8YEZzo1/h62JNAtfdlZAUJ o1i4asv9vwt6YoLkJvPzREaXkeSIjGu8bmtZTy60u+jsc9g4pU7K7P3Y c4ftzt4HeK2/SrS8PoHLdMPQsPNxGwvhbb80k+aoeITvMDJ2R6HHdbj5 hfA=
add ecFEC5.hahnekedar. 2648 IN RRSIG NSEC 8 2 2648 20220718231722 20220630140351 54646 hahnekedar. L6bNP7szNfC6Md0IbQvVS2vAmElKhRrdIJYwcGrTjAvpF3jjTOPtjVd6 TSsq9Z8KjNyoH/6fPsKWiExCHPMPXRF7PHN62+li/5axU9ObklqLit+z tq4ekP4hiNnsKDkBJRDw/4LtetGy3DreuI7PzFBFxHVSkxN63Zsws6EE KPw=
add fau69a83d99.hahnekedar. 2648 IN RRSIG NSEC 8 2 2648 20220718231722 20220630140351 54646 hahnekedar. Eyqb/OtO6F7xhmG6iPT268td64oglqfCsxA1qO5LCCup1G0uyObjB3Sp AUx2SY8vx1nNamEawLI/H+oEaUPjN6bhGZZbrhdCFjGvu3E4iUFC0xMp zaLeFXMwFH4KpdeFOuIq+h4wd+uPU8hS+dI6QKFJpgjUy4JlY82PU7e9 bfI=
add ns2.hahnekedar. 2648 IN RRSIG NSEC 8 2 2648 20220718231722 20220630140351 54646 hahnekedar. vX9Os5VqbgS8mMCzIqYoTnrKnhANAYxcu0/vJIYf2hlzqhKc6+WVUpjs Xf8Nmy1EwV5HAjZWkPkvfrAXfyAUEXyeXeVCPAHIbFSWE9GCg9DRaKxR Rwl7PjIADrxS8A3tRaEUc/VWNiSv2DBRPmJU0EeZq5fthhDP5i1telSC OPg=
add xyz.ns2.hahnekedar. 2648 IN RRSIG NSEC 8 3 2648 20220718231722 20220630140351 54646 hahnekedar. UkRBxDJNZ/oNt9f5uKqynzuGVF8S1GFHD54Gtb1AKFIrTXjcagOFPGRL nmGwzZQZ7Cn3TI+4iUUzRkA8gcGxrrgsp6uZyf0M1EJi6sqAVdZPoa8f qLW+RUDZNj34qTtJJF3AEcCJr9uLt2BXFof4dKkp9ggZxEtQz9IG4iqJ rhM=
add pub2a0.hahnekedar. 2648 IN RRSIG NSEC 8 2 2648 20220718231722 20220630140351 54646 hahnekedar. i4UA98/A9+ffiYVYBAmqZctmskhteBA8wj9gPuVooaAWMdtA8Fn7qLxb V4I/aYL96JbN/ht11f3NpkpWGzia+KKewHyQZ0GMwuFdrSiLxqPoCdxa JVd0hiNHvQKVLuuwNiqh2UBxXwBg3Z/bX6gPQDxkj5k+Of/WHuOuJB4C KWQ=
add xyz.pub2a0.hahnekedar. 2648 IN RRSIG NSEC 8 3 2648 20220718231722 20220630140351 54646 hahnekedar. eOg5aJ8O2Q+9XIL1b17JdnAmJJp3fm4y/XdfqnDHxtBek1vIt2PCERnR sLGc9+dTmn+XeJ8lPjbWzofG97Mtl2OS5cDxurbyPW5rST7svpiNDzEe N/rU3JsoWwbzJO3nEAbYYjIvMoKcMo/pF+0128yqpLLGEM9l1cEvZnW5 Xw4=
add xyz.xyz.hahnekedar. 2648 IN RRSIG NSEC 8 3 2648 20220718231722 20220630140351 54646 hahnekedar. ObP4lVTa8gghLfH4nQcUaaHiGRZlJbo490aySgcUuXsVrz1U2yitAXZ+ D7H2MYQlo0Ya/bNwz7xC105d9qZpexsvoFwNMzhhA9iUXLKK3SrRhxnP J0X2zLDyRhkltn3P4mF5yXwg3E7vQe7NeFe+Wpw2IVJqZsv5KB40AwGq dZ0=
add 0acC77eFAbbdc268.hahnekedar. 2648 IN NSEC xyz.2Ce98A477.hahnekedar. AAAA RRSIG NSEC
add xyz.2Ce98A477.hahnekedar. 2648 IN NSEC _sip._udp.671A1.hahnekedar. MX RRSIG NSEC
add _sip._udp.671A1.hahnekedar. 2648 IN NSEC xyz._sip._udp.671A1.hahnekedar. SRV RRSIG NSEC
add xyz._sip._udp.671A1.hahnekedar. 2648 IN NSEC 68Dbb6914Fc4e.hahnekedar. SRV RRSIG NSEC
add a7a.hahnekedar. 2648 IN NSEC xyz.a7a.hahnekedar. AAAA RRSIG NSEC
add xyz.a7a.hahnekedar. 2648 IN NSEC aEc7940DfdDEb.hahnekedar. AAAA RRSIG NSEC
add bl7b907b61.hahnekedar. 2648 IN NSEC xyz.bl7b907b61.hahnekedar. AAAA RRSIG NSEC
add xyz.bl7b907b61.hahnekedar. 2648 IN NSEC _sip._udp.protocol.CCb3.hahnekedar. AAAA RRSIG NSEC
add ecFEC5.hahnekedar. 2648 IN NSEC f30.hahnekedar. A RRSIG NSEC
add fau69a83d99.hahnekedar. 2648 IN NSEC _sip._udp.grid.hahnekedar. A RRSIG NSEC
add ns2.hahnekedar. 2648 IN NSEC xyz.ns2.hahnekedar. A RRSIG NSEC
add xyz.ns2.hahnekedar. 2648 IN NSEC pub2a0.hahnekedar. A RRSIG NSEC
add pub2a0.hahnekedar. 2648 IN NSEC xyz.pub2a0.hahnekedar. AAAA RRSIG NSEC
add xyz.pub2a0.hahnekedar. 2648 IN NSEC xyz.xyz.hahnekedar. AAAA RRSIG NSEC
add xyz.xyz.hahnekedar. 2648 IN NSEC hahnekedar. A RRSIG NSEC
del hahnekedar. 2648 IN SOA ns.hahnekedar. username.hahnekedar. 345896694 3600 1200 2419200 2648
del fau69a83d99.hahnekedar. 2648 IN A 84.195.165.254
del 623bC33D3B.normandy.hahnekedar. 2648 IN NS 0acC77eFAbbdc268.hahnekedar.
del hahnekedar. 2648 IN RRSIG SOA 8 1 2648 20220730150351 20220630140351 54646 hahnekedar. IahqYdkP/6OFhyXEKWB13M2eCgMPWrSLonWVYIWE5GeWJuV2wKFp2xYd WbduWLj9jlchQbpCb1WvZZUiNdZLJqvpCx4YkWt0mFqW5PZyDq7Rz1VM j53d6JkpKlKw8gSgt0y9RoMJKXGaz4IpvzMBDulAr88uhU5vy4XLn/uD BfQ=
del fau69a83d99.hahnekedar. 2648 IN RRSIG A 8 2 2648 20220720235742 20220630140325 54646 hahnekedar. BOTESc7VHASmQOWJ6R+x7Re1qC61AyuAljG8IsRdG9c+CivlZVFI3XFi AOzW63YZVfvf3mbtgED96Y8tnhQVz4a0Ny/mITS/5A0XO/GAfrP9DWbA aVkvILUWHmqHZUZZQZIE6WIMw7h/0a13IowwLkWJU19UimLG4A0L102u g7w=
del fau69a83d99.hahnekedar. 2648 IN RRSIG NSEC 8 2 2648 20220718231722 20220630140351 54646 hahnekedar. Eyqb/OtO6F7xhmG6iPT268td64oglqfCsxA1qO5LCCup1G0uyObjB3Sp AUx2SY8vx1nNamEawLI/H+oEaUPjN6bhGZZbrhdCFjGvu3E4iUFC0xMp zaLeFXMwFH4KpdeFOuIq+h4wd+uPU8hS+dI6QKFJpgjUy4JlY82PU7e9 bfI=
del 623bC33D3B.normandy.hahnekedar. 2648 IN RRSIG NSEC 8 3 2648 20220721114036 20220630140325 54646 hahnekedar. Ok+p2mXO/3fR1sveRxDiMgGDUXlW49edOW7w6DVAFipCNvX+mEsf/j6B /z3a52AU8b2kXmZHVkINapm11ZZOGWdZkqxfTU4mwCvGbqZFMm06nJmC B96IxlFmDcqfn6BOnUgpQjVy9CCz/sFFJTLVT/aRp5SQnxyeypbWQHz2 YU4=
del assuming-control.hahnekedar. 2648 IN RRSIG NSEC 8 2 2648 20220729153646 20220630140325 54646 hahnekedar. 0dGbtAuuCwKomF7plmLdL2nv6VD/idu8nbi8iteAsNVaJxsz0ZCYHPHv ApOdKcR7HPejJtBRa6MDdryPSmxU47qGkxKv5CaUDL2Gb7xJfx6aD4kl XKcCmnUZZEbnl9FFOA9AW9BQNrfiwKrENM3tlMTNnCl1LNeRhqUgyrOX 608=
del f75cd935ddEAee38.hahnekedar. 2648 IN RRSIG NSEC 8 2 2648 20220720235742 20220630140325 54646 hahnekedar. Yc0K6qKm731PfU8w+BbyDuDGUhAT/v39jfOeWl6nymwVZNbGNHNX+GoS djA4pXX4+IQJzxuBk5lONumJo2lmpHEd9zNijVKh7dwGDA7+C5RD6KHT 4kRBlNd7MFjxCXaPLlgpOWBNx08eL+Q6dbLdE5xXY948+d7Ma93FeC1i wwM=
del nexus5b2002b.hahnekedar. 2648 IN RRSIG NSEC 8 2 2648 20220716100219 20220630140325 54646 hahnekedar. JfVSZWSDL7iFs0SIUbkiovCkIUMP5HI3JNzUFDEk2J3UmVK+N3xoGfh1 XLbWGt39uWIOASnIk8TEC9c6G8E9khLpNnAL1QmTkQlkRJ+5UGvoa0cb MiUDClMPIXO6nUZnzIuM7EjbzFK0Nsq4d/mGhC6OuUnYitC7Zjda/H4V 6Dc=
del xyz.xyz.hahnekedar. 2648 IN RRSIG NSEC 8 3 2648 20220718231722 20220630140351 54646 hahnekedar. ObP4lVTa8gghLfH4nQcUaaHiGRZlJbo490aySgcUuXsVrz1U2yitAXZ+ D7H2MYQlo0Ya/bNwz7xC105d9qZpexsvoFwNMzhhA9iUXLKK3SrRhxnP J0X2zLDyRhkltn3P4mF5yXwg3E7vQe7NeFe+Wpw2IVJqZsv5KB40AwGq dZ0=
del fau69a83d99.hahnekedar. 2648 IN NSEC _sip._udp.grid.hahnekedar. A RRSIG NSEC
del 623bC33D3B.normandy.hahnekedar. 2648 IN NSEC ns.hahnekedar. NS RRSIG NSEC
del assuming-control.hahnekedar. 2648 IN NSEC bl7b907b61.hahnekedar. CNAME RRSIG NSEC
del f75cd935ddEAee38.hahnekedar. 2648 IN NSEC fau69a83d99.hahnekedar. LOC RRSIG NSEC
del nexus5b2002b.hahnekedar. 2648 IN NSEC 623bC33D3B.normandy.hahnekedar. NS RRSIG NSEC
del xyz.xyz.hahnekedar. 2648 IN NSEC hahnekedar. A RRSIG NSEC
add hahnekedar. 2648 IN SOA ns.hahnekedar. username.hahnekedar. 345896695 3600 1200 2419200 2648
add xyz.hahnekedar.hahnekedar. 0 IN NS elkoss.hahnekedar.
add xyz.assuming-control.hahnekedar. 0 IN CNAME fB10a30E6eF5dE40.hahnekedar.
add xyz.xyz.hahnekedar. 0 IN AAAA fd9c:20c0:91fc:cb36:e87c:1f6b:3b46:cf28
add hahnekedar. 2648 IN RRSIG SOA 8 1 2648 20220730150358 20220630140358 54646 hahnekedar. GCrdijPFrcpZG5PT/ot6iBSx45K+mdq79+wOSznTDeNsw6/v9wvrQgA6 x2Rn4TfeKQ7aq2ZImFpveiR4pZ7jxx6/8ZtwWH9BVaabNr3KapomkqaB iCFJtqJndtoHW/lwPeNl5wE+/PwysuWCVqkyudjfEozBToOdo7JNxO7r GlM=
add xyz.assuming-control.hahnekedar. 0 IN RRSIG CNAME 8 3 0 20220725200453 20220630140358 54646 hahnekedar. K38W9+66tRFYcgf9kyUmTbgHbYTuF3oF4IFVXtBpV4JjW34lq41a3ftP knAyjCfVFp4n5VLyqoseHwWiEcnddnnfwGcPfPniOlj9GZCiQ0ihcP8h PYe1+Olc7tZA7c+U4QsiosuxPSGiPC52wtR/wR4ARokt1FH8yCcoh+4z jog=
add xyz.xyz.hahnekedar. 0 IN RRSIG AAAA 8 3 0 20220725200453 20220630140358 54646 hahnekedar. seH/ntazJr3QWuDLcE+h28cQF62XrkPohioZ/wn6v9jfbIPJGKVMVzHf qfmmZC2HlNYV1+cTqQQ3g50/Z7HW5EWg6oi7TMHhgEq4xVJ/h3vrsHmc g8u7w//6Q8sI1AeMcLWBokGeCsmpiCqeHQoGS/FFah/yX+Ji9EbJv4if jIw=
add assuming-control.hahnekedar. 2648 IN RRSIG NSEC 8 2 2648 20220725200453 20220630140358 54646 hahnekedar. pcN/Sja1FzxShSsfKgni3GNi5axAnAXy4uR9MT4Ll6DpGD8zGcptzWyF CX/jHmWqUmGxjNRgWueOlix3Ki1u2Mjq5OdDWmhkDIt+hi9ObYH72yGz 4tOnrfvdC2mp6ochv2MkxqNfGzzzkA0LKzNV4rudlELlLaBrMKKVBjel 0Bs=
add xyz.assuming-control.hahnekedar. 2648 IN RRSIG NSEC 8 3 2648 20220725200453 20220630140358 54646 hahnekedar. DDibxXdK1ss2XWZsV+XX91DK3Kx/Hre2p2sDtKZSef5q6kwezxPy57sU RstEBEA+CZog6O5/t+EIEmDAA9Vj43bgxfM/y8SeJ1Ll4/PqKpZlyJYd LMWt/5cJk+GavNaSRZ5Qxw72T52kEvcaFR2T2iNPG6/MygGx/NaFFnvB kZw=
add f75cd935ddEAee38.hahnekedar. 2648 IN RRSIG NSEC 8 2 2648 20220725200453 20220630140358 54646 hahnekedar. pgfrrkMrp9Z+zB17gI0VtUuEY5HPSSbA//yEzkIzau4aFzQwT8iHA8Px 14YHac/bi7UQXjevM19FWRwpZHd8m+sPsTHIhEVhLTodNSm6HcgsxYmd kvfDjVybsg6Xjo2bJX9/2RmNeY3T31RB5ts4BgTpk8982zzqwIVFx0mo G8U=
add nexus5b2002b.hahnekedar. 2648 IN RRSIG NSEC 8 2 2648 20220725200453 20220630140358 54646 hahnekedar. gJxMggNCMdNZsZvQ7tI32COR9NopCRiHG0VUViBDzh9RbnUxbiqBLcJW X51wfLzLnRaOKp8/eEuZ5O8MxCAJycL9hJRDaGOztGykLcI3nMR6quFc qqvViMz3hPgJpNRIqClIr2L5NhLLoYDrR1L/yZo/RhuJ4+KFiSKfFhXd 2Hw=
add xyz.xyz.hahnekedar. 2648 IN RRSIG NSEC 8 3 2648 20220725200453 20220630140358 54646 hahnekedar. ykB150lyAJro6CvENSzlCVJ34VD2jxwpCoosqtB9N5sXqgnDmcy96NhO Up4Ng447q3tG2Oq7+LH0siwrZCFVJ3LjCUvF5HWwTrZTMiHAIgA+oH2i E4jlRqbB/8FyyJhRF2ZtKeXI+jo2Pe5DlAc65sCr/dw0yoqtLgl/R4kd +Nk=
add assuming-control.hahnekedar. 2648 IN NSEC xyz.assuming-control.hahnekedar. CNAME RRSIG NSEC
add xyz.assuming-control.hahnekedar. 2648 IN NSEC bl7b907b61.hahnekedar. CNAME RRSIG NSEC
add f75cd935ddEAee38.hahnekedar. 2648 IN NSEC _sip._udp.grid.hahnekedar. LOC RRSIG NSEC
add nexus5b2002b.hahnekedar. 2648 IN NSEC ns.hahnekedar. NS RRSIG NSEC
add xyz.xyz.hahnekedar. 2648 IN NSEC hahnekedar. A AAAA RRSIG NSEC
del hahnekedar. 2648 IN SOA ns.hahnekedar. username.hahnekedar. 345896695 3600 1200 2419200 2648
del nexus.hahnekedar. 2648 IN A 182.188.108.174
del hahnekedar. 2648 IN RRSIG SOA 8 1 2648 20220730150358 20220630140358 54646 hahnekedar. GCrdijPFrcpZG5PT/ot6iBSx45K+mdq79+wOSznTDeNsw6/v9wvrQgA6 x2Rn4TfeKQ7aq2ZImFpveiR4pZ7jxx6/8ZtwWH9BVaabNr3KapomkqaB iCFJtqJndtoHW/lwPeNl5wE+/PwysuWCVqkyudjfEozBToOdo7JNxO7r GlM=
del nexus.hahnekedar. 2648 IN RRSIG A 8 2 2648 20220716100219 20220630140325 54646 hahnekedar. z/cC3zcVlxVA1TPjbT7wKqfqX2TAhaMvpbjnZH0LxTkS9rRuGKMTQKXC R+wqsOtH1ga75TqVC7ZP2kF+donBESBcDA4fRAq6k98lYh40TJyKNLWA DeBHwW8PBgb9nPDzylC0XBwYS9/ghHjMg3sKD2A4M9xOR/YEy2EOWvzJ GP0=
del nexus.hahnekedar. 2648 IN RRSIG NSEC 8 2 2648 20220716100219 20220630140325 54646 hahnekedar. b9JCqITdbcKbjOaigxxu9brTnpkcwI8WmIJoMxLzkg+s9y/OVveVc1wg jYPCc4XjqJiXdPujX4gaokRsDU8UDyDmZ8BUNCdY/3LAjKVywwKwzTKP 9Q2WrGFq60fi/6ew+2bMFwdJlzgWXvDsSslGdMNn2/r2WM1dSf3QO5qv Y6g=
del 0acC77eFAbbdc268.hahnekedar. 2648 IN RRSIG NSEC 8 2 2648 20220718231722 20220630140351 54646 hahnekedar. kQXr8PiNDG9IwnJG+d17dlHpJoZSMFO6AqJyS5R+9FuUgk8NX+tFqkOE 39lfDF8+xfavsiuR7luOYY9Y5fOM9/2qkCWP6dvdXw3HNrqD/aRrMW1K PERGgrqqdzAGaiGlNF9Kpc8erjAp1to+lbwVlok7n/4pxBxNUWlJmrXj F/E=
del customer.hahnekedar. 2648 IN RRSIG NSEC 8 2 2648 20220719173022 20220630140325 54646 hahnekedar. R7jC+oTa3Dh48LZfB0ogmH3oJ8RsdVTzmvkjr76+Dfhd0+QOO6uW4AO5 j14U3n88C4cUK9VbMzDNKLr98hcB/CaCCITALR0Dvyyo3kC4D00cXjHZ FCsVofMP9gA4M8KEALgQdDrZ7RZ8/KyDooPyVPK2iqaayiNVnnVsMn6R SDs=
del ne05cc.hahnekedar. 2648 IN RRSIG NSEC 8 2 2648 20220716100219 20220630140325 54646 hahnekedar. sBHhFLoDr4ED3PVdSAlPoCX88y7BGgnfY+C0Ji9ynAl6ofqyfT5msfiW uSzB2lOAC1HA5zs8mHWJ91/DJupwvqLxEclkCDrJZjura8Oq1chB44I0 VPLT20gG8KujGijyMkjeR3o492S+63nCk0iQZJPJ8kVv94jQNSR9s0Ex 9fE=
del xyz.xyz.hahnekedar. 2648 IN RRSIG NSEC 8 3 2648 20220725200453 20220630140358 54646 hahnekedar. ykB150lyAJro6CvENSzlCVJ34VD2jxwpCoosqtB9N5sXqgnDmcy96NhO Up4Ng447q3tG2Oq7+LH0siwrZCFVJ3LjCUvF5HWwTrZTMiHAIgA+oH2i E4jlRqbB/8FyyJhRF2ZtKeXI+jo2Pe5DlAc65sCr/dw0yoqtLgl/R4kd +Nk=
del nexus.hahnekedar. 2648 IN NSEC nexus5b2002b.hahnekedar. A RRSIG NSEC
del 0acC77eFAbbdc268.hahnekedar. 2648 IN NSEC xyz.2Ce98A477.hahnekedar. AAAA RRSIG NSEC
del customer.hahnekedar. 2648 IN NSEC DCB285c85e6.hahnekedar. CNAME RRSIG NSEC
del ne05cc.hahnekedar. 2648 IN NSEC nexus.hahnekedar. A RRSIG NSEC
del xyz.xyz.hahnekedar. 2648 IN NSEC hahnekedar. A AAAA RRSIG NSEC
add hahnekedar. 2648 IN SOA ns.hahnekedar. username.hahnekedar. 345896696 3600 1200 2419200 2648
add xyz.xyz.hahnekedar. 0 IN NS elkoss.hahnekedar.
add xyz.customer.hahnekedar. 0 IN CNAME rosenkov.hahnekedar.
add xyz.0acC77eFAbbdc268.hahnekedar. 0 IN AAAA fd9c:20c0:91fc:cb36:aaed:e102:c5de:51a2
add hahnekedar. 2648 IN RRSIG SOA 8 1 2648 20220730150405 20220630140405 54646 hahnekedar. GLhH8KEDcajSr2gGrZGnKQyi2sbfLH0CcpcDIO1Li6k5ZqY/bi25OiXb ORJ1IKjJdQ4/bU22rCAxjsSOXYGF1CnJ2JkDkXpvZgl6yxWh6PdH7iXu M+M7z9+eaf4SpXvskTxotOhjBFaBpmh4S3AooFE7/hPV4R6FcOQGh1RQ Vlg=
add xyz.0acC77eFAbbdc268.hahnekedar. 0 IN RRSIG AAAA 8 3 0 20220714050033 20220630140405 54646 hahnekedar. gCYEiWyOyV6z4WY50yCFoYEBm33EbfHK+IPzl7tsosOrPq0SNZjdS/j8 u3BFS0L3zESl6QtnVUQu8pkMfSEcZz0sE94F8b086OXSAkTAIXMsvXxZ zf2wmCfQI1u+pRr1tWRieyAiebQ9NuDQ/3ZqT03MRQIJL8l9RthIvykO O3Q=
add xyz.customer.hahnekedar. 0 IN RRSIG CNAME 8 3 0 20220714050033 20220630140405 54646 hahnekedar. hS3RPH9ukbqqFpJJEr668yk8wUiX9OOCBaScavREQl468T6B5+gDLYsa fMdrj7E5HmAONznlih5c2utXmUSDH1SgHL0FEbP/eB4ir7LrmFEyhOjV ZWCuw1u2EiNp4fxGIw0bHE4273RisxLIpibxRuVQrvqrZtxpwUdEprHr 5k0=
add 0acC77eFAbbdc268.hahnekedar. 2648 IN RRSIG NSEC 8 2 2648 20220714050033 20220630140405 54646 hahnekedar. W4YDPjri0Vu9tJr11oDl13Gz1W+HjX0MbUiUZnDI5FALYxV9H3R/w+Rs w3p/nPCMgMsfhOj+2Zh3EubpvXp09QiPIFVXfXjvwcnW7bBA39Bx2F1t JAmlt65KPdLbix+veez32Et+CbZ3lkSLpoE2oEDBBXZZemkC1a/JPTdM GYI=
add xyz.0acC77eFAbbdc268.hahnekedar. 2648 IN RRSIG NSEC 8 3 2648 20220714050033 20220630140405 54646 hahnekedar. 0vaxSNYGS/Qzpt8rY4WDagnak3lVT9/ZO9Hgq+wP2pz6i0IAwUzU+3y8 v5jEWtcImbA9MA/htH1YvRAEOKAPtkBgfaMynQsoqy2+F8NiA4Nslee1 l4DqATmy1NqIcK0qr3TAMlECXHv59fB/aUlqJpFO7ZpZadh5wiV0bVKb 0qA=
add customer.hahnekedar. 2648 IN RRSIG NSEC 8 2 2648 20220714050033 20220630140405 54646 hahnekedar. bRq3GcqhB888x11nxdhywIaWcVwGpfpI0zDv5WqHgmHl5xM4iI3Np/Io vfsFqYqg5T1HaTy9h8sKDAV7tVOff30tjDOE3fqiADoHi/arSUG38oO4 KHdEjCzFMWSnxt6+nOxlaHhuiPFWV23HqRnLn3t5hWeHflmAVNpThcDD 9WQ=
add xyz.customer.hahnekedar. 2648 IN RRSIG NSEC 8 3 2648 20220714050033 20220630140405 54646 hahnekedar. kTV2b5iS5VOVt+tx27QxEzlOOEG+pLqkve1nmgcBqNA9tMlsSj/HUz8n iV+xIubbY/aIUbRskfCZPdbw0EA9oT+4P/DXZpv2fndXg90hviJvAFwL gCbQwLAknpMxQJ9YHQnuETXY8hhRfFj8MPBVMqUNK2ET+7jq3cQ15+9g 8+U=
add ne05cc.hahnekedar. 2648 IN RRSIG NSEC 8 2 2648 20220714050033 20220630140405 54646 hahnekedar. oeJyXlKBRNiB55mDfGnpb+2aoxjwTDxHX6+s89FTXx4+OthF7Q0W6TJD xiQZvVDGzAreoSccAP8FDELWbSCO2Gz9FjZWWJwkMCjZrueC+A1eBEZj w2rTUigKrVL7U6dY8dy90KunQMf50VzUQEZVM0ylPTydowkbmEk/mVVo W04=
add xyz.xyz.hahnekedar. 2648 IN RRSIG NSEC 8 3 2648 20220714050033 20220630140405 54646 hahnekedar. EQEXU9OBa17qQhpAbRvvsOeGAnIwg8hXdykY0UNCJ4XFpxk7Iv/UchSI nh2c2ZisCX8Ulq6eCXnj37U4XMQBSCXbXpHj1SFae/lJ59c0GMXpVn1b /DRM6g1VTJjM9JX6y7Wa+dpxyJziaqP8bVWwqWHGAhW1Hzeh63feaPsZ Yhg=
add 0acC77eFAbbdc268.hahnekedar. 2648 IN NSEC xyz.0acC77eFAbbdc268.hahnekedar. AAAA RRSIG NSEC
add xyz.0acC77eFAbbdc268.hahnekedar. 2648 IN NSEC xyz.2Ce98A477.hahnekedar. AAAA RRSIG NSEC
add customer.hahnekedar. 2648 IN NSEC xyz.customer.hahnekedar. CNAME RRSIG NSEC
add xyz.customer.hahnekedar. 2648 IN NSEC DCB285c85e6.hahnekedar. CNAME RRSIG NSEC
add ne05cc.hahnekedar. 2648 IN NSEC nexus5b2002b.hahnekedar. A RRSIG NSEC
add xyz.xyz.hahnekedar. 2648 IN NSEC hahnekedar. NS RRSIG NSEC
```
### Possible fixes
Good luck :)Not plannedhttps://gitlab.isc.org/isc-projects/bind9/-/issues/3430upgrade from Ubuntu 20.04 to ISC packages on Launchpad break `host`2022-07-04T07:31:50ZPetr Špačekpspacek@isc.orgupgrade from Ubuntu 20.04 to ISC packages on Launchpad break `host`### Summary
Upgrade from Ubuntu-supplied packages to ISC-supplied packages from Launchpad break `host` utility.
### BIND version used
Platform: Ubuntu 20.04
Package version: 1:9.18.4-1+ubuntu20.04.1+isc+1
### Steps to reproduce
```
...### Summary
Upgrade from Ubuntu-supplied packages to ISC-supplied packages from Launchpad break `host` utility.
### BIND version used
Platform: Ubuntu 20.04
Package version: 1:9.18.4-1+ubuntu20.04.1+isc+1
### Steps to reproduce
```
sudo add-apt-repository ppa:isc/bind
sudo apt update
sudo apt install bind9
```
### What is the current *bug* behavior?
Problem:
```console
$ host -V
host: error while loading shared libraries: libdns.so.1601: cannot open shared object file: No such file or directory
```
```console
$ dpkg -l | grep bind9
ii bind9 1:9.18.4-1+ubuntu20.04.1+isc+1 amd64 Internet Domain Name Server
ii bind9-dnsutils 1:9.18.4-1+ubuntu20.04.1+isc+1 amd64 Clients provided with BIND 9
ii bind9-host 1:9.16.1-0ubuntu2.10 amd64 DNS Lookup Utility
ii bind9-libs:amd64 1:9.18.4-1+ubuntu20.04.1+isc+1 amd64 Shared Libraries used by BIND 9
ii bind9-utils 1:9.18.4-1+ubuntu20.04.1+isc+1 amd64 Utilities for BIND 9
```
### What is the expected *correct* behavior?
Reporter expected the -host package to correctly upgrade.
FTR I did not discover this but it was reported to me privately.Ondřej SurýOndřej Surýhttps://gitlab.isc.org/isc-projects/bind9/-/issues/3428Dig 9.18 times out on mDNS queries2022-06-30T12:54:49ZLarry StoneDig 9.18 times out on mDNS queries<!--
If the bug you are reporting is potentially security-related - for example,
if it involves an assertion failure or other crash in `named` that can be
triggered repeatedly - then please do *NOT* report it here, but send an
email to [...<!--
If the bug you are reporting is potentially security-related - for example,
if it involves an assertion failure or other crash in `named` that can be
triggered repeatedly - then please do *NOT* report it here, but send an
email to [security-officer@isc.org](security-officer@isc.org).
-->
### Summary
Dig times out when attempting to resolve a mDNS query. This is new behavior with 9.18; dig worked fine with 9.16 and before. I get the same behavior with both a built from source copy of dig and one ported from MacPorts.
### BIND version used
```
BIND 9.18.3 (Stable Release) <id:16aefa3>
running on Darwin arm64 21.5.0 Darwin Kernel Version 21.5.0: Tue Apr 26 21:08:37 PDT 2022; root:xnu-8020.121.3~4/RELEASE_ARM64_T6000
built by make with '--prefix=/opt/local' '--disable-silent-rules' '--mandir=/opt/local/share/man' '--with-openssl=/opt/local' '--with-libidn2=/opt/local' '--enable-doh' 'CC=/usr/bin/clang' 'CFLAGS=-pipe -Os -isysroot/Library/Developer/CommandLineTools/SDKs/MacOSX12.sdk -arch arm64' 'LDFLAGS=-L/opt/local/lib -Wl,-headerpad_max_install_names -Wl,-syslibroot,/Library/Developer/CommandLineTools/SDKs/MacOSX12.sdk -arch arm64' 'CPPFLAGS=-I/opt/local/include -isysroot/Library/Developer/CommandLineTools/SDKs/MacOSX12.sdk'
compiled by CLANG Apple LLVM 13.1.6 (clang-1316.0.21.2.5)
compiled with OpenSSL version: OpenSSL 3.0.3 3 May 2022
linked to OpenSSL version: OpenSSL 3.0.3 3 May 2022
compiled with libuv version: 1.44.1
linked to libuv version: 1.44.1
compiled with libnghttp2 version: 1.47.0
linked to libnghttp2 version: 1.47.0
compiled with libxml2 version: 2.9.14
linked to libxml2 version: 20914
compiled with json-c version: 0.15
linked to json-c version: 0.15
compiled with zlib version: 1.2.12
linked to zlib version: 1.2.12
threads support is enabled
default paths:
named configuration: /opt/local/etc/named.conf
rndc configuration: /opt/local/etc/rndc.conf
DNSSEC root key: /opt/local/etc/bind.keys
nsupdate session key: /opt/local/var/run/named/session.key
named PID file: /opt/local/var/run/named/named.pid
named lock file: /opt/local/var/run/named/named.lock
```
### Steps to reproduce
Attempt an mDNS query with dig 9.18 as shown below.
### What is the current *bug* behavior?
```
$ dig +short @224.0.0.251 -p 5353 Maggie.local
;; connection timed out; no servers could be reached
```
### What is the expected *correct* behavior?
```
$ dig +short @224.0.0.251 -p 5353 Maggie.local
192.168.0.82
```
### Relevant configuration files
N/A
### Relevant logs and/or screenshots
PCAP file attached (if I've read tcpdump correctly, the query goes out and is answered but dig doesn't see it).[dig9_18mdns_202206272218.pcap](/uploads/1fa41ca129e9114aad64ac1ce49adf1c/dig9_18mdns_202206272218.pcap)
### Possible fixes
Unknownhttps://gitlab.isc.org/isc-projects/bind9/-/issues/3413Improve synth-from-dnssec NSEC search algorithm2022-06-17T07:03:21ZMark AndrewsImprove synth-from-dnssec NSEC search algorithmTake the signer for NSEC RRSIGs and use that name to find a tree in which to store and find the NSECs. Currently the NSECs are stored in a single tree which means the search can miss NSECs which a present in the cache. This sort of str...Take the signer for NSEC RRSIGs and use that name to find a tree in which to store and find the NSECs. Currently the NSECs are stored in a single tree which means the search can miss NSECs which a present in the cache. This sort of structure will also be needed for NSEC3 lookups when we extend synth-from-dnssec to use NSEC3's.Not plannedhttps://gitlab.isc.org/isc-projects/bind9/-/issues/3409CID 353496: Error handling issue in lib/isc/netmgr/netmgr.c2022-07-07T08:04:26ZMichal NowakCID 353496: Error handling issue in lib/isc/netmgr/netmgr.cCoverity Scan finds suspicious that `isc__nm_process_sock_buffer()`'s return value is not being checked in `lib/isc/netmgr/netmgr.c`, it is elsewhere:
```
lib/isc/netmgr/netmgr.c: isc__nm_process_sock_buffer(sock);
lib/isc/netmgr/tcpd...Coverity Scan finds suspicious that `isc__nm_process_sock_buffer()`'s return value is not being checked in `lib/isc/netmgr/netmgr.c`, it is elsewhere:
```
lib/isc/netmgr/netmgr.c: isc__nm_process_sock_buffer(sock);
lib/isc/netmgr/tcpdns.c: result = isc__nm_process_sock_buffer(sock);
lib/isc/netmgr/tcpdns.c: result = isc__nm_process_sock_buffer(sock);
lib/isc/netmgr/tcpdns.c: result = isc__nm_process_sock_buffer(csock);
lib/isc/netmgr/tlsdns.c: result = isc__nm_process_sock_buffer(sock);
lib/isc/netmgr/tlsdns.c: result = isc__nm_process_sock_buffer(sock);
lib/isc/netmgr/tlsdns.c: result = isc__nm_process_sock_buffer(sock);
lib/isc/netmgr/tlsdns.c: result = isc__nm_process_sock_buffer(sock);
lib/isc/netmgr/tlsdns.c: result = isc__nm_process_sock_buffer(csock);
```
Related commit b432d5d3bcccf199141564b6a87d2cdac296ed7e.
From `v9_18`:
```
*** CID 353496: Error handling issues (CHECKED_RETURN)
/lib/isc/netmgr/netmgr.c: 2364 in isc__nm_resume_processing()
2358 REQUIRE(!atomic_load(&sock->client));
2359
2360 if (isc__nmsocket_closing(sock)) {
2361 return;
2362 }
2363
>>> CID 353496: Error handling issues (CHECKED_RETURN)
>>> Calling "isc__nm_process_sock_buffer" without checking return value (as is done elsewhere 8 out of 9 times).
2364 isc__nm_process_sock_buffer(sock);
2365 }
2366
2367 void
2368 isc_nmhandle_cleartimeout(isc_nmhandle_t *handle) {
2369 REQUIRE(VALID_NMHANDLE(handle));
```Not plannedOndřej SurýOndřej Surýhttps://gitlab.isc.org/isc-projects/bind9/-/issues/3396Cached RRSIGs need to be more tightly bound to the covered RRset2024-03-01T10:04:57ZMark AndrewsCached RRSIGs need to be more tightly bound to the covered RRsetIt is currently possible for the RRSIG's to be deleted from the cache while the covered RRset remains (e.g. removed for space reasons). This causes problems for downstream validators as they won't get the RRSIGs returned along with RRse...It is currently possible for the RRSIG's to be deleted from the cache while the covered RRset remains (e.g. removed for space reasons). This causes problems for downstream validators as they won't get the RRSIGs returned along with RRset requested.
Provide a mechanism to tightly bind the RRSIGs to the covered RRset so that they can't be deleted separately. Perhaps adding methods
```
isc_result_t
dns_rdataset_addrrsigs(dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset);
isc_result_t
dns_rdataset_getrrsigs(dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset);
```
could be used attach and retrieve a RRSIG RRset to a non-RRSIG RRset. The cache would no longer maintain seperate RRSIG RRsets but return those bound to the covered RRset.Not plannedMark AndrewsMark Andrewshttps://gitlab.isc.org/isc-projects/bind9/-/issues/3393upforwd test failure: "checking DNSTAP logging of UPDATE forwarded update rep...2022-06-07T12:28:57ZArаm Sаrgsyаnupforwd test failure: "checking DNSTAP logging of UPDATE forwarded update replies" mismatchhttps://gitlab.isc.org/isc-projects/bind9/-/jobs/2555471
```
...
...
I:upforwd:checking update forwarding to dead primary (14)
I:upforwd:checking DNSTAP logging of UPDATE forwarded update replies (15)
I:upforwd:UQ=5 UR=0
I:upforwd:check...https://gitlab.isc.org/isc-projects/bind9/-/jobs/2555471
```
...
...
I:upforwd:checking update forwarding to dead primary (14)
I:upforwd:checking DNSTAP logging of UPDATE forwarded update replies (15)
I:upforwd:UQ=5 UR=0
I:upforwd:checking update forwarding to with sig0 (16)
I:upforwd:checking DNSTAP logging of UPDATE forwarded update replies (17)
I:upforwd:UQ=14 UR=1
I:upforwd:failed
I:upforwd:exit status: 1
I:upforwd:stopping servers
```
This failure happened in a branch based on `v9_16`, so I'm setting only the ~"Affects v9.16" label at this moment.
The log files are attached.
[upforwd.tar.gz](/uploads/5600d1e3da02749e5b334a57222d91c5/upforwd.tar.gz)Not plannedhttps://gitlab.isc.org/isc-projects/bind9/-/issues/3391add current View name to dnstap messages2022-08-25T04:13:28ZPeter Muchadd current View name to dnstap messages### Description
A combined nameserver for authoritative and recursive tasks, for intranet and public service, plus root-slave etc., may need six or more partially interconnected views. Dnstap is the perfect tool to debug and verify that...### Description
A combined nameserver for authoritative and recursive tasks, for intranet and public service, plus root-slave etc., may need six or more partially interconnected views. Dnstap is the perfect tool to debug and verify that all of it actually does what is intended. But for this to be successful, information about which view is currently acting, would be needed in each dnstap message.
### Request
The 'dnstap-identity' option should work within a view statement. (The documentation does not state that it does /not/ work, but it gets rejected by the software.)
Then the admin could choose an appropriate name to their liking individually in each view.
### Links / references
https://lists.isc.org/pipermail/bind-users/2022-June/106295.html
https://lists.isc.org/pipermail/bind-users/2022-June/106296.htmlNot plannedhttps://gitlab.isc.org/isc-projects/bind9/-/issues/3390Building unit tests separately has been broken2022-07-07T07:58:09ZArtem BoldarievBuilding unit tests separately has been brokenIt seems that recent unit tests refactoring broke ability to build unit tests separately.
For example:
```
$ pwd
<project root>/tests/isc
$ make doh_test
No rule to make target '../../tests/libtest/libtest.la'
```
The issue makes it h...It seems that recent unit tests refactoring broke ability to build unit tests separately.
For example:
```
$ pwd
<project root>/tests/isc
$ make doh_test
No rule to make target '../../tests/libtest/libtest.la'
```
The issue makes it harder to debug errors in the code which these tests are supposed to verify.Not plannedhttps://gitlab.isc.org/isc-projects/bind9/-/issues/3384Various coverity issues in contrib/ (CID 352903-352921)2022-05-31T14:44:39ZMichal NowakVarious coverity issues in contrib/ (CID 352903-352921)When isc-projects/bind9#3310 is resolved Coverity Scan will identify the following issues in `contrib/` sources.
I run Coverity Scan in my private `bind-mnowak` project over the `3310-build-contrib-in-ci` branch in advance, should anyon...When isc-projects/bind9#3310 is resolved Coverity Scan will identify the following issues in `contrib/` sources.
I run Coverity Scan in my private `bind-mnowak` project over the `3310-build-contrib-in-ci` branch in advance, should anyone care of these inherently ~Low issues.
```
** CID 352921: (USE_AFTER_FREE)
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 464 in build_query()
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 464 in build_query()
________________________________________________________________________________________________________
*** CID 352921: (USE_AFTER_FREE)
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 464 in build_query()
458 }
459 }
460
461 fail:
462 va_end(ap1);
463
>>> CID 352921: (USE_AFTER_FREE)
>>> Using freed pointer "arglist.head".
464 while ((item = DLZ_LIST_HEAD(arglist)) != NULL) {
465 if (item->arg != NULL) {
466 free(item->arg);
467 }
468 free(item);
469 }
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 464 in build_query()
458 }
459 }
460
461 fail:
462 va_end(ap1);
463
>>> CID 352921: (USE_AFTER_FREE)
>>> Using freed pointer "arglist.head".
464 while ((item = DLZ_LIST_HEAD(arglist)) != NULL) {
465 if (item->arg != NULL) {
466 free(item->arg);
467 }
468 free(item);
469 }
** CID 352919: Integer handling issues (NO_EFFECT)
/contrib/dlz/modules/perl/dlz_perl_callback_clientinfo.c: 268 in boot_DLZ_Perl__clientinfo()
________________________________________________________________________________________________________
*** CID 352919: Integer handling issues (NO_EFFECT)
/contrib/dlz/modules/perl/dlz_perl_callback_clientinfo.c: 268 in boot_DLZ_Perl__clientinfo()
262 XS_EXTERNAL(boot_DLZ_Perl__clientinfo); /* prototype to pass -Wmissing-prototypes */
263 XS_EXTERNAL(boot_DLZ_Perl__clientinfo)
264 {
265 #if PERL_VERSION_LE(5, 21, 5)
266 dVAR; dXSARGS;
267 #else
>>> CID 352919: Integer handling issues (NO_EFFECT)
>>> This less-than-zero comparison of an unsigned value is never true. "0UL > 255UL".
268 dVAR; dXSBOOTARGSXSAPIVERCHK;
269 #endif
270 #if (PERL_REVISION == 5 && PERL_VERSION < 9)
271 char* file = __FILE__;
272 #else
273 const char* file = __FILE__;
** CID 352918: (LOCK)
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 1546 in dlz_closeversion()
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 1546 in dlz_closeversion()
________________________________________________________________________________________________________
*** CID 352918: (LOCK)
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 1546 in dlz_closeversion()
1540 }
1541 }
1542
1543 /*
1544 * Unlock the mutex for this txn
1545 */
>>> CID 352918: (LOCK)
>>> "pthread_mutex_unlock" unlocks "txn->dbi->mutex" while it is unlocked.
1546 dlz_mutex_unlock(&txn->dbi->mutex);
1547
1548 /*
1549 * Free up other structures
1550 */
1551 free(txn->zone);
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 1499 in dlz_closeversion()
1493 mysql_free_result(res);
1494 }
1495
1496 /*
1497 * Commit the transaction to the database
1498 */
>>> CID 352918: (LOCK)
>>> "db_execute" unlocks "txn->dbi->mutex" while it is unlocked.
1499 result = db_execute(state, txn->dbi, "COMMIT");
1500 if (result != ISC_R_SUCCESS && state->log != NULL) {
1501 state->log(ISC_LOG_INFO,
1502 "%s: (%x) commit transaction on zone %s",
1503 modname, txn, zone);
1504 return;
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 1546 in dlz_closeversion()
1540 }
1541 }
1542
1543 /*
1544 * Unlock the mutex for this txn
1545 */
>>> CID 352918: (LOCK)
>>> "pthread_mutex_unlock" unlocks "txn->dbi->mutex" while it is unlocked.
1546 dlz_mutex_unlock(&txn->dbi->mutex);
1547
1548 /*
1549 * Free up other structures
1550 */
1551 free(txn->zone);
** CID 352917: API usage errors (LOCK)
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 655 in db_query()
________________________________________________________________________________________________________
*** CID 352917: API usage errors (LOCK)
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 655 in db_query()
649 state->log(ISC_LOG_INFO, "%s: query(%d) returned %d rows",
650 modname, dbi->id, mysql_num_rows(res));
651 }
652
653 fail:
654 if (dbi != NULL && localdbi) {
>>> CID 352917: API usage errors (LOCK)
>>> "pthread_mutex_unlock" unlocks "dbi->mutex" while it is unlocked.
655 dlz_mutex_unlock(&dbi->mutex);
656 }
657 return (res);
658 }
659
660 /*
** CID 352916: (STRING_OVERFLOW)
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 901 in makerecord()
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 902 in makerecord()
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 900 in makerecord()
________________________________________________________________________________________________________
*** CID 352916: (STRING_OVERFLOW)
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 901 in makerecord()
895 data = strtok_r(NULL, "\t", &saveptr);
896 if (data == NULL) {
897 goto error;
898 }
899
900 strcpy(new_record->name, name);
>>> CID 352916: (STRING_OVERFLOW)
>>> You might overrun the 10-character fixed-size string "new_record->type" by copying "type" without checking the length.
901 strcpy(new_record->type, type);
902 strcpy(new_record->data, data);
903 sprintf(new_record->ttl, "%d", ttlvalue);
904
905 free(buf);
906 return (new_record);
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 902 in makerecord()
896 if (data == NULL) {
897 goto error;
898 }
899
900 strcpy(new_record->name, name);
901 strcpy(new_record->type, type);
>>> CID 352916: (STRING_OVERFLOW)
>>> You might overrun the 200-character fixed-size string "new_record->data" by copying "data" without checking the length.
902 strcpy(new_record->data, data);
903 sprintf(new_record->ttl, "%d", ttlvalue);
904
905 free(buf);
906 return (new_record);
907
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 900 in makerecord()
894
895 data = strtok_r(NULL, "\t", &saveptr);
896 if (data == NULL) {
897 goto error;
898 }
899
>>> CID 352916: (STRING_OVERFLOW)
>>> You might overrun the 100-character fixed-size string "new_record->name" by copying "name" without checking the length.
900 strcpy(new_record->name, name);
901 strcpy(new_record->type, type);
902 strcpy(new_record->data, data);
903 sprintf(new_record->ttl, "%d", ttlvalue);
904
905 free(buf);
** CID 352915: Security best practices violations (DC.WEAK_CRYPTO)
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 686 in make_notify()
________________________________________________________________________________________________________
*** CID 352915: Security best practices violations (DC.WEAK_CRYPTO)
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 686 in make_notify()
680 }
681
682 *packetlen = strlen(zone) + 18;
683 memset(packet, 0, *packetlen);
684
685 /* Random query ID */
>>> CID 352915: Security best practices violations (DC.WEAK_CRYPTO)
>>> "rand" should not be used for security-related applications, because linear congruential algorithms are too easy to break.
686 i = rand();
687 packet[0] = htons(i) & 0xff;
688 packet[1] = htons(i) >> 8;
689
690 /* Flags (OpCode '4' in bits 14-11), Auth Answer set in bit 10 */
691 i = 0x2400;
** CID 352914: Null pointer dereferences (FORWARD_NULL)
/contrib/dlz/modules/sqlite3/dlz_sqlite3_dynamic.c: 414 in sqlite3_get_resultset()
________________________________________________________________________________________________________
*** CID 352914: Null pointer dereferences (FORWARD_NULL)
/contrib/dlz/modules/sqlite3/dlz_sqlite3_dynamic.c: 414 in sqlite3_get_resultset()
408
409 if (rsp != NULL) {
410 *rsp = rs;
411 }
412
413 cleanup:
>>> CID 352914: Null pointer dereferences (FORWARD_NULL)
>>> Dereferencing null pointer "dbi".
414 if (dbi->zone != NULL) {
415 free(dbi->zone);
416 dbi->zone = NULL;
417 }
418 if (dbi->record != NULL) {
419 free(dbi->record);
** CID 352913: Integer handling issues (NO_EFFECT)
/contrib/dlz/modules/perl/dlz_perl_callback.c: 317 in boot_DLZ_Perl()
________________________________________________________________________________________________________
*** CID 352913: Integer handling issues (NO_EFFECT)
/contrib/dlz/modules/perl/dlz_perl_callback.c: 317 in boot_DLZ_Perl()
311 XS_EXTERNAL(boot_DLZ_Perl); /* prototype to pass -Wmissing-prototypes */
312 XS_EXTERNAL(boot_DLZ_Perl)
313 {
314 #if PERL_VERSION_LE(5, 21, 5)
315 dVAR; dXSARGS;
316 #else
>>> CID 352913: Integer handling issues (NO_EFFECT)
>>> This less-than-zero comparison of an unsigned value is never true. "0UL > 255UL".
317 dVAR; dXSBOOTARGSXSAPIVERCHK;
318 #endif
319 #if (PERL_REVISION == 5 && PERL_VERSION < 9)
320 char* file = __FILE__;
321 #else
322 const char* file = __FILE__;
** CID 352912: API usage errors (LOCK)
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 480 in build_query()
________________________________________________________________________________________________________
*** CID 352912: API usage errors (LOCK)
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 480 in build_query()
474 }
475 if (querystr != NULL) {
476 free(querystr);
477 }
478
479 if (dbi != NULL && localdbi) {
>>> CID 352912: API usage errors (LOCK)
>>> "pthread_mutex_unlock" unlocks "dbi->mutex" while it is unlocked.
480 dlz_mutex_unlock(&dbi->mutex);
481 }
482
483 return (query);
484 }
485
** CID 352911: Error handling issues (CHECKED_RETURN)
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 739 in send_notify()
________________________________________________________________________________________________________
*** CID 352911: Error handling issues (CHECKED_RETURN)
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 739 in send_notify()
733 addr->sin_port = htons(53);
734
735 if ((s = socket(PF_INET, SOCK_DGRAM, 0)) < 0) {
736 return;
737 }
738
>>> CID 352911: Error handling issues (CHECKED_RETURN)
>>> Calling "sendto(s, p, plen, 0, (struct sockaddr *)addr, 16U)" without checking return value. This library function may fail and return an error code.
739 sendto(s, p, plen, 0, (struct sockaddr *)addr, sizeof(*addr));
740 close(s);
741 return;
742 }
743
744 /*
** CID 352910: Memory - illegal accesses (UNINIT)
/contrib/dlz/modules/bdbhpt/dlz_bdbhpt_dynamic.c: 272 in dlz_allowzonexfr()
________________________________________________________________________________________________________
*** CID 352910: Memory - illegal accesses (UNINIT)
/contrib/dlz/modules/bdbhpt/dlz_bdbhpt_dynamic.c: 272 in dlz_allowzonexfr()
266 /* free any memory duplicate string in the key field */
267 if (key.data != NULL) {
268 free(key.data);
269 }
270
271 /* free any memory allocated to the data field. */
>>> CID 352910: Memory - illegal accesses (UNINIT)
>>> Using uninitialized value "data.data".
272 if (data.data != NULL) {
273 free(data.data);
274 }
275
276 return (result);
277 }
** CID 352909: (RESOURCE_LEAK)
/contrib/dlz/modules/bdbhpt/dlz_bdbhpt_dynamic.c: 727 in dlz_create()
/contrib/dlz/modules/bdbhpt/dlz_bdbhpt_dynamic.c: 687 in dlz_create()
________________________________________________________________________________________________________
*** CID 352909: (RESOURCE_LEAK)
/contrib/dlz/modules/bdbhpt/dlz_bdbhpt_dynamic.c: 727 in dlz_create()
721 default:
722 db->log(ISC_LOG_ERROR,
723 "bdbhpt_dynamic: "
724 "operating mode must be set to P or C or T. "
725 "You specified '%s'",
726 argv[1]);
>>> CID 352909: (RESOURCE_LEAK)
>>> Variable "db" going out of scope leaks the storage it points to.
727 return (ISC_R_FAILURE);
728 }
729
730 /*
731 * create bdbhpt environment
732 * Basically bdbhpt allocates and assigns memory to db->dbenv
/contrib/dlz/modules/bdbhpt/dlz_bdbhpt_dynamic.c: 687 in dlz_create()
681 /* verify we have 4 arg's passed to the driver */
682 if (argc != 4) {
683 db->log(ISC_LOG_ERROR,
684 "bdbhpt_dynamic: please supply 3 command line args. "
685 "You supplied: %s",
686 argc);
>>> CID 352909: (RESOURCE_LEAK)
>>> Variable "db" going out of scope leaks the storage it points to.
687 return (ISC_R_FAILURE);
688 }
689
690 switch ((char)*argv[1]) {
691 /*
692 * Transactional mode. Highest safety - lowest speed.
** CID 352908: API usage errors (LOCK)
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 1043 in dlz_create()
________________________________________________________________________________________________________
*** CID 352908: API usage errors (LOCK)
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 1043 in dlz_create()
1037 }
1038
1039 free(state->db_name);
1040 free(state->db_host);
1041 free(state->db_user);
1042 free(state->db_pass);
>>> CID 352908: API usage errors (LOCK)
>>> "pthread_mutex_destroy" destroys "state->tx_mutex" while it is locked.
1043 dlz_mutex_destroy(&state->tx_mutex);
1044 free(state);
1045 return (ISC_R_FAILURE);
1046 }
1047
1048 /*
** CID 352907: Error handling issues (CHECKED_RETURN)
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 1023 in dlz_create()
________________________________________________________________________________________________________
*** CID 352907: Error handling issues (CHECKED_RETURN)
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 1023 in dlz_create()
1017 /*
1018 * Populate DB instances
1019 */
1020 if (mysql_thread_safe()) {
1021 for (n = 0; n < MAX_DBI; n++) {
1022 dlz_mutex_init(&state->db[n].mutex, NULL);
>>> CID 352907: Error handling issues (CHECKED_RETURN)
>>> Calling "pthread_mutex_lock" without checking return value (as is done elsewhere 24 out of 29 times).
1023 dlz_mutex_lock(&state->db[n].mutex);
1024 state->db[n].id = n;
1025 state->db[n].connected = 0;
1026 state->db[n].sock = mysql_init(NULL);
1027 mysql_options(state->db[n].sock,
1028 MYSQL_READ_DEFAULT_GROUP, modname);
** CID 352906: Memory - illegal accesses (UNINIT)
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 464 in build_query()
________________________________________________________________________________________________________
*** CID 352906: Memory - illegal accesses (UNINIT)
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 464 in build_query()
458 }
459 }
460
461 fail:
462 va_end(ap1);
463
>>> CID 352906: Memory - illegal accesses (UNINIT)
>>> Using uninitialized value "arglist.head".
464 while ((item = DLZ_LIST_HEAD(arglist))) {
465 item = DLZ_LIST_NEXT(item, link);
466 if (item->arg != NULL) {
467 free(item->arg);
468 }
469 free(item);
** CID 352905: Incorrect expression (COPY_PASTE_ERROR)
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 1419 in dlz_newversion()
________________________________________________________________________________________________________
*** CID 352905: Incorrect expression (COPY_PASTE_ERROR)
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 1419 in dlz_newversion()
1413 } else {
1414 dlz_mutex_unlock(&state->tx_mutex);
1415 if (newtx != NULL) {
1416 if (newtx->zone != NULL) {
1417 free(newtx->zone);
1418 }
>>> CID 352905: Incorrect expression (COPY_PASTE_ERROR)
>>> "zone" in "newtx->zone" looks like a copy-paste error.
1419 if (newtx->zone != NULL) {
1420 free(newtx->zone_id);
1421 }
1422 free(newtx);
1423 }
1424 }
** CID 352904: Error handling issues (CHECKED_RETURN)
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 567 in validate_txn()
________________________________________________________________________________________________________
*** CID 352904: Error handling issues (CHECKED_RETURN)
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 567 in validate_txn()
561
562 static isc_result_t
563 validate_txn(mysql_data_t *state, mysql_transaction_t *txn) {
564 isc_result_t result = ISC_R_FAILURE;
565 mysql_transaction_t *txp;
566
>>> CID 352904: Error handling issues (CHECKED_RETURN)
>>> Calling "pthread_mutex_lock" without checking return value (as is done elsewhere 24 out of 29 times).
567 dlz_mutex_lock(&state->tx_mutex);
568 for (txp = state->transactions; txp != NULL; txp = txp->next) {
569 if (txn == txp) {
570 result = ISC_R_SUCCESS;
571 break;
572 }
** CID 352903: Error handling issues (CHECKED_RETURN)
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 1445 in dlz_closeversion()
________________________________________________________________________________________________________
*** CID 352903: Error handling issues (CHECKED_RETURN)
/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c: 1445 in dlz_closeversion()
1439 MYSQL_RES *res;
1440 MYSQL_ROW row;
1441
1442 /*
1443 * Find the transaction
1444 */
>>> CID 352903: Error handling issues (CHECKED_RETURN)
>>> Calling "pthread_mutex_lock" without checking return value (as is done elsewhere 24 out of 29 times).
1445 dlz_mutex_lock(&state->tx_mutex);
1446 if (state->transactions == txn) {
1447 /* Tx is first in list; remove it. */
1448 state->transactions = txn->next;
1449 } else {
1450 txp = state->transactions;
```Not plannedhttps://gitlab.isc.org/isc-projects/bind9/-/issues/3382named shutdown blocks on dnstap Unix domain socket2022-06-14T16:42:04ZBorja Marcos EA2EKHnamed shutdown blocks on dnstap Unix domain socket<!--
If the bug you are reporting is potentially security-related - for example,
if it involves an assertion failure or other crash in `named` that can be
triggered repeatedly - then please do *NOT* report it here, but send an
email to [...<!--
If the bug you are reporting is potentially security-related - for example,
if it involves an assertion failure or other crash in `named` that can be
triggered repeatedly - then please do *NOT* report it here, but send an
email to [security-officer@isc.org](security-officer@isc.org).
-->
### Summary
When using a Unix domain socket for dnstap output, named blocks when shutting down (either using `rndc stop` or `kill -TERM`) if the socket is connected and the dnstap server process is not consuming messages.
### BIND version used
Affects both 9.16 and 9.18 (tested on FreeBSD)
### Steps to reproduce
1. Configure dnstap to use a Unix domain socket.
1. Start a dnstap server process (for example dnstap/golang-dnstap).
1. Let named process some queries
1. Stop the dnstap process either with `kill -STOP` or using ctrl-Z if running in foreground
1. Send some more queries to named to make sure there are unprocessed dnstap messages
1. Try to stop named using `rndc stop` or `kill -TERM`
### What is the current *bug* behavior?
The named process stays blocked forever.
It won't exit unless the dnstap server process is killed or resumed, consuming the messages buffered in the Unix socket.
The process has closed all of its descriptors, so it won't answer queries nor respond to `rndc`.
### What is the expected *correct* behavior?
The process should terminate. Maybe a short timeout would be in order, but it should not block on dnstap output.
### Relevant configuration files
```
# named-checkconf -px
logging {
channel "graylog" {
syslog "local1";
severity info;
print-time iso8601-utc;
print-category yes;
};
category "default" {
"graylog";
};
};
options {
directory "/usr/local/etc/namedb/working";
dnstap-output unix"/tmp/dnstap.sock";
dump-file "/var/dump/named_dump.db";
listen-on {
127.0.0.1/32;
};
listen-on {
192.168.1.155/32;
};
listen-on-v6 {
::1/128;
X:Y:Z:5353::1/128;
X:Y:Z:5353::2/128;
};
pid-file "/var/run/named/pid";
querylog yes;
recursive-clients 256;
statistics-file "/var/stats/named.stats";
allow-recursion {
127.0.0.1/32;
192.168.1.0/24;
192.168.2.0/24;
192.168.3.0/24;
192.168.0.0/16;
::1/128;
X:Y:Z::/48;
};
disable-empty-zone "255.255.255.255.IN-ADDR.ARPA";
disable-empty-zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA";
disable-empty-zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA";
dnssec-validation auto;
dnstap {
all;
};
max-cache-size 16777216;
query-source address X.Y.Z.T port 0;
request-nsid no;
resolver-query-timeout 20000;
send-cookie no;
stale-answer-enable no;
allow-query {
127.0.0.1/32;
192.168.1.0/24;
192.168.2.0/24;
192.168.3.0/24;
X.Y.Z.T/32;
192.168.0.0/16;
::1/128;
X:Y:Z::/48;
};
transfer-source X.Y.Z.T;
};
statistics-channels {
inet 127.0.0.1 port 8053 allow {
127.0.0.1/32;
};
};
server 82.159.210.51/32 {
send-cookie no;
};
server 2001:500:94::/48 {
bogus yes;
};
server 204.13.251.136/32 {
bogus yes;
};
server 208.78.71.136/32 {
bogus yes;
};
zone "." {
type mirror;
};
zone "localhost" {
type master;
file "/usr/local/etc/namedb/primary/localhost-forward.db";
};
zone "127.in-addr.arpa" {
type master;
file "/usr/local/etc/namedb/primary/localhost-reverse.db";
};
zone "255.in-addr.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "rpzzone" {
type master;
file "/usr/local/etc/namedb/primary/rpz.db";
};
zone "0.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/localhost-reverse.db";
};
zone "0.0.192.in-addr.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "test" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "example" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "invalid" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "example.com" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "example.net" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "example.org" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "18.198.in-addr.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "19.198.in-addr.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "240.in-addr.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "241.in-addr.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "242.in-addr.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "243.in-addr.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "244.in-addr.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "245.in-addr.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "246.in-addr.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "247.in-addr.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "248.in-addr.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "249.in-addr.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "250.in-addr.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "251.in-addr.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "252.in-addr.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "253.in-addr.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "254.in-addr.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "1.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "3.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "4.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "5.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "6.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "7.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "8.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "9.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "a.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "b.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "c.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "d.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "e.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "0.f.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "1.f.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "2.f.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "3.f.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "4.f.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "5.f.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "6.f.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "7.f.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "8.f.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "9.f.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "a.f.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "b.f.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "0.e.f.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "1.e.f.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "2.e.f.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "3.e.f.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "4.e.f.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "5.e.f.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "6.e.f.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "7.e.f.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "c.f.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "d.f.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "c.e.f.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "d.e.f.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "e.e.f.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "f.e.f.ip6.arpa" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
zone "ip6.int" {
type master;
file "/usr/local/etc/namedb/primary/empty.db";
};
```
### Relevant logs and/or screenshots
```
9943 100117 named SCTL "kern.hostname"
9943 100117 named RET __sysctl 0
9943 100117 named CALL getpid
9943 100117 named RET getpid 9943/0x26d7
9943 100117 named CALL sendto(0x3,0x7fffffffc3b0,0x6c,0,0,0)
9943 100117 named GIO fd 3 wrote 108 bytes
"<142>1 2022-05-30T10:32:37.874081+00:00 elnuc named 9943 - - 2022-05-3\
0T10:32:37.874Z dnstap: closing dnstap"
9943 100117 named RET sendto 108/0x6c
9943 100117 named CALL _umtx_op(0x802102000,0x2<UMTX_OP_WAIT>,0x32d6e,0,0)
```
After resuming the dnstap process,
```
9943 208238 named GIO fd 78 wrote 4096 bytes
(some data written)
9943 208238 named RET sendmsg 8153/0x1fd9
9943 208238 named CALL sendmsg(0x4e,0x7fffdedf4ec0,0x20000<MSG_NOSIGNAL>)
9943 208238 named GIO fd 78 wrote 4096 bytes
(more data)
9943 208238 named RET sendmsg 7236/0x1c44
9943 208238 named CALL sendmsg(0x4e,0x7fffdedf4e30,0x20000<MSG_NOSIGNAL>)
9943 208238 named GIO fd 78 wrote 12 bytes
0x0000 0000 0000 0000 0004 0000 0003 |............|
9943 208238 named RET sendmsg 12/0xc
9943 208238 named CALL read(0x4e,0x7fffdedf4edc,0x4)
9943 208238 named GIO fd 78 read 4 bytes
"\0\0\0\0"
9943 208238 named RET read 4
9943 208238 named CALL read(0x4e,0x7fffdedf4edc,0x4)
9943 208238 named GIO fd 78 read 4 bytes
0x0000 0000 0004 |....|
9943 208238 named RET read 4
9943 208238 named CALL read(0x4e,0x7fffdedf4eb0,0x4)
9943 208238 named GIO fd 78 read 4 bytes
0x0000 0000 0005 |....|
9943 208238 named RET read 4
9943 208238 named CALL close(0x4e)
9943 208238 named RET close 0
9943 208238 named CALL madvise(0x802f79000,0x16000,MADV_FREE)
9943 208238 named RET madvise 0
9943 208238 named CALL madvise(0x801570000,0x1d000,MADV_FREE)
9943 208238 named RET madvise 0
9943 208238 named CALL madvise(0x8014c9000,0x5000,MADV_FREE)
9943 208238 named RET madvise 0
9943 208238 named CALL madvise(0x801526000,0x27000,MADV_FREE)
9943 208238 named RET madvise 0
9943 208238 named CALL madvise(0x80159c000,0x5e000,MADV_FREE)
9943 208238 named RET madvise 0
9943 208238 named CALL thr_exit(0x802102000)
9943 100117 named RET _umtx_op 0 **LOOKS LIKE IT WAS BLOCKED HERE**
9943 100117 named CALL __sysctl(0x7fffffffa2f0,0x2,0x7fffffffe400,0x7fffffffa2e8,0,0)
9943 100117 named SCTL "kern.hostname"
9943 100117 named RET __sysctl 0
9943 100117 named CALL getpid
9943 100117 named RET getpid 9943/0x26d7
9943 100117 named CALL sendto(0x3,0x7fffffffc400,0x66,0,0,0)
9943 100117 named GIO fd 3 wrote 102 bytes
"<141>1 2022-05-30T10:47:41.246758+00:00 elnuc named 9943 - - 2022-05-3\
0T10:47:41.246Z general: exiting"
9943 100117 named RET sendto 102/0x66
9943 100117 named CALL close(0x4)
9943 100117 named RET close 0
9943 100117 named CALL close(0x3)
9943 100117 named RET close 0
9943 100117 named CALL unlink(0x8020eba80)
9943 100117 named NAMI "/var/run/named/pid"
```
### Possible fixes
(If you can, link to the line of code that might be responsible for the
problem.)Not plannedhttps://gitlab.isc.org/isc-projects/bind9/-/issues/3379Expose general health indication in stats2023-12-12T05:50:59ZTony FinchExpose general health indication in statsA suggestion from Chris Siebenmann's blog:
https://utcc.utoronto.ca/~cks/space/blog/sysadmin/HaveGeneralHealthMetric
> If your system is reasonably decent sized, it probably has some sort of logging framework that categorizes log messag...A suggestion from Chris Siebenmann's blog:
https://utcc.utoronto.ca/~cks/space/blog/sysadmin/HaveGeneralHealthMetric
> If your system is reasonably decent sized, it probably has some sort of logging framework that categorizes log messages by both subsystem and broad level of alarmingness. Add a hook into your logging system so that you track the last time a message was emitted for a given subsystem at a given priority level, and expose these times (with level and subsystem) as metrics. Then people like me can put together monitoring for things like 'the Prometheus TSDB has logged warnings or above within the last five minutes'.Not plannedhttps://gitlab.isc.org/isc-projects/bind9/-/issues/3365dig failed to recover from BADVERS2022-05-18T10:19:15ZMichal Nowakdig failed to recover from BADVERSThe `ednscompliance:DiG's EDNS negotiation` test [failed](https://gitlab.isc.org/isc-projects/bind9/-/jobs/2519819) on `main`.
It seems that `dig +norec +edns=100 soa .` failed to recover from `BADVERS` as the `dig` output only has:
```...The `ednscompliance:DiG's EDNS negotiation` test [failed](https://gitlab.isc.org/isc-projects/bind9/-/jobs/2519819) on `main`.
It seems that `dig +norec +edns=100 soa .` failed to recover from `BADVERS` as the `dig` output only has:
```
;; BADVERS, retrying with EDNS version 0.
```
But it failed to get the answer after retry with `+edns=0`, e.g.:
```
;; BADVERS, retrying with EDNS version 0.
; <<>> DiG 9.19.2-dev <<>> +norec -p 5300 @10.53.0.1 +edns soa .
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35055
;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 7c052ec018904c4f010000006284bd9f4d9b5e1f230ffc1a (good)
;; QUESTION SECTION:
;. IN SOA
;; ANSWER SECTION:
. 300 IN SOA marka.isc.org. a.root.servers.nil. 2010 600 600 1200 600
;; AUTHORITY SECTION:
. 300 IN NS a.root-servers.nil.
;; ADDITIONAL SECTION:
a.root-servers.nil. 300 IN A 10.53.0.6
;; Query time: 1 msec
;; SERVER: 10.53.0.1#5300(10.53.0.1) (UDP)
;; WHEN: Wed May 18 11:34:23 CEST 2022
;; MSG SIZE rcvd: 169
```
[named.run](/uploads/4b2f774a90d08fed77ba28e6b8fb353d/named.run)Not plannedhttps://gitlab.isc.org/isc-projects/bind9/-/issues/3363dns64 auto configuration on nat64 networks2022-05-19T08:54:56ZMark Andrewsdns64 auto configuration on nat64 networksListen to router advertisements and use PREF64 option if present to construct a DNS64 entry, otherwise use the nameservers listed to perform ipv4only.arpa AAAA query, otherwise if the O bit is set get the DNS servers from DHCPv6.Listen to router advertisements and use PREF64 option if present to construct a DNS64 entry, otherwise use the nameservers listed to perform ipv4only.arpa AAAA query, otherwise if the O bit is set get the DNS servers from DHCPv6.Not plannedhttps://gitlab.isc.org/isc-projects/bind9/-/issues/3340rpz QNAME rewrite a3-8.tld2 stop on unrecognized qresult in rpz_rewrite() failed2022-05-09T20:50:45ZMichal Nowakrpz QNAME rewrite a3-8.tld2 stop on unrecognized qresult in rpz_rewrite() failed`rpz:checking crashes` system test [failed](https://gitlab.isc.org/isc-private/bind9/-/jobs/2501631) with:
```
I:rpz:checking crashes (9)
I:rpz:performance not checked; queryperf not available
I:rpz:error messages in ns6/named.run starti...`rpz:checking crashes` system test [failed](https://gitlab.isc.org/isc-private/bind9/-/jobs/2501631) with:
```
I:rpz:checking crashes (9)
I:rpz:performance not checked; queryperf not available
I:rpz:error messages in ns6/named.run starting with:
I:rpz:ns6/named.run:09-May-2022 16:15:13.528 client @0x802559160 10.53.0.6#43512 (a3-8.tld2): rpz QNAME rewrite a3-8.tld2 stop on unrecognized qresult in rpz_rewrite() failed: operation canceled
```
<details><summary>ns6/named.run</summary>
```
09-May-2022 16:15:01.526 clientmgr @0x8024c8000 attach: 3
09-May-2022 16:15:01.526 query client=0x802559160 thread=0x801c13400(<unknown-query>): query_reset
09-May-2022 16:15:01.526 client @0x802559160 (no-peer): allocate new client
09-May-2022 16:15:01.526 client @0x802559160 10.53.0.6#43512: TCP request
09-May-2022 16:15:01.526 client @0x802559160 10.53.0.6#43512: using view '_default'
09-May-2022 16:15:01.526 client @0x802559160 10.53.0.6#43512: request is not signed
09-May-2022 16:15:01.526 client @0x802559160 10.53.0.6#43512: recursion available
09-May-2022 16:15:01.526 query client=0x802559160 thread=0x801c13400(<unknown-query>): ns_query_start
09-May-2022 16:15:01.526 query client=0x802559160 thread=0x801c13400(a3-8.tld2/ANY): qctx_init
09-May-2022 16:15:01.526 query client=0x802559160 thread=0x801c13400(a3-8.tld2/ANY): client attr:0x2103, query attr:0x303, restarts:0, origqname:a3-8.tld2, timer:0, authdb:0, referral:0
09-May-2022 16:15:01.526 query client=0x802559160 thread=0x801c13400(a3-8.tld2/ANY): ns__query_start
09-May-2022 16:15:01.526 client @0x802559160 10.53.0.6#43512 (a3-8.tld2): query (cache) 'a3-8.tld2/ANY/IN' approved
09-May-2022 16:15:01.526 query client=0x802559160 thread=0x801c13400(a3-8.tld2/ANY): query_lookup
09-May-2022 16:15:01.526 query client=0x802559160 thread=0x801c13400(a3-8.tld2/ANY): query_gotanswer
09-May-2022 16:15:01.526 client @0x802559160 10.53.0.6#43512 (a3-8.tld2): rrl=0x0, HAVECOOKIE=0, result=DNS_R_DELEGATION, fname=0x8024ead80(1), is_zone=0, RECURSIONOK=1, query.rpz_st=0x0(0), RRL_CHECKED=0
09-May-2022 16:15:01.526 query client=0x802559160 thread=0x801c13400(a3-8.tld2/ANY): query_checkrpz
09-May-2022 16:15:01.526 query client=0x802559160 thread=0x801c13400(a3-8.tld2/ANY): rpz_rewrite
09-May-2022 16:15:01.526 query client=0x802559160 thread=0x801c13400(a3-8.tld2/ANY): rpz_ck_dnssec
09-May-2022 16:15:01.526 query client=0x802559160 thread=0x801c13400(a3-8.tld2/ANY): query_delegation
09-May-2022 16:15:01.526 query client=0x802559160 thread=0x801c13400(a3-8.tld2/ANY): query_delegation_recurse
09-May-2022 16:15:01.526 query client=0x802559160 thread=0x801c13400(a3-8.tld2/ANY): ns_query_recurse
09-May-2022 16:15:01.526 fetch: a3-8.tld2/ANY
09-May-2022 16:15:01.526 res 0x8024e40c0: attach
09-May-2022 16:15:01.526 res 0x8024e40c0: attach
09-May-2022 16:15:01.526 fctx 0x8038d7c00(a3-8.tld2/ANY): create
09-May-2022 16:15:01.526 log_ns_ttl: fctx 0x8038d7c00: fctx_create: a3-8.tld2 (in 'tld2'?): 1 116
09-May-2022 16:15:01.526 fctx 0x8038d7c00(a3-8.tld2/ANY): join
09-May-2022 16:15:01.526 fctx 0x8038d7c00(a3-8.tld2/ANY): addevent
09-May-2022 16:15:01.526 fetch 0x802c1c080 (fctx 0x8038d7c00(a3-8.tld2/ANY)): created
09-May-2022 16:15:01.526 query client=0x802559160 thread=0x801c13400(a3-8.tld2/ANY): ns_query_done
09-May-2022 16:15:01.526 fctx 0x8038d7c00(a3-8.tld2/ANY): start
09-May-2022 16:15:01.526 fctx 0x8038d7c00(a3-8.tld2/ANY): try fctx->qc=0
09-May-2022 16:15:01.526 fctx 0x8038d7c00(a3-8.tld2/ANY): cancelqueries
09-May-2022 16:15:01.526 fctx 0x8038d7c00(a3-8.tld2/ANY): getaddresses fctx->depth=0
09-May-2022 16:15:01.526 findaddrinfo: found entry 0x8024e4700
09-May-2022 16:15:01.526 fctx 0x8038d7c00(a3-8.tld2/ANY): query
09-May-2022 16:15:01.526 dispatch 0x802530c00: UDP connected (0x802c01200): success
09-May-2022 16:15:01.526 resquery 0x80281ec00 (fctx 0x8038d7c00(a3-8.tld2/ANY)): connected
09-May-2022 16:15:01.526 resquery 0x80281ec00 (fctx 0x8038d7c00(a3-8.tld2/ANY)): send
09-May-2022 16:15:01.526 sending packet to 10.53.0.3#31859
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32311
;; flags: rd; QUESTION: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
; COOKIE: e0ad29ea0481b9c30100000062793e05e7d24a8fef7243b5
;; QUESTION SECTION:
;a3-8.tld2. IN ANY
09-May-2022 16:15:01.526 resquery 0x80281ec00 (fctx 0x8038d7c00(a3-8.tld2/ANY)): sent
09-May-2022 16:15:01.526 resquery 0x80281ec00 (fctx 0x8038d7c00(a3-8.tld2/ANY)): senddone
09-May-2022 16:15:02.728 dispatch 0x802530c00: UDP response 0x802c01200:timed out:requests 1
09-May-2022 16:15:02.728 resquery 0x80281ec00 (fctx 0x8038d7c00(a3-8.tld2/ANY)): response
09-May-2022 16:15:02.728 fctx 0x8038d7c00(a3-8.tld2/ANY): timeout
09-May-2022 16:15:02.728 fctx 0x8038d7c00(a3-8.tld2/ANY): query timed out; no response
09-May-2022 16:15:02.728 fctx 0x8038d7c00(a3-8.tld2/ANY): [result: timed out] query canceled in rctx_done(); no response
09-May-2022 16:15:02.728 fctx 0x8038d7c00(a3-8.tld2/ANY): cancelquery
09-May-2022 16:15:02.728 dispatch 0x802530c00: detach: refcount 2
09-May-2022 16:15:02.728 fctx 0x8038d7c00(a3-8.tld2/ANY): resend
09-May-2022 16:15:02.728 fctx 0x8038d7c00(a3-8.tld2/ANY): query
09-May-2022 16:15:02.728 fctx 0x8038d7c00(a3-8.tld2/ANY): timed out
09-May-2022 16:15:02.728 dispatch 0x802530c00: detach: refcount 1
09-May-2022 16:15:02.728 dispatch 0x80252f000: UDP connected (0x802c01400): success
09-May-2022 16:15:02.728 resquery 0x80281ec00 (fctx 0x8038d7c00(a3-8.tld2/ANY)): connected
09-May-2022 16:15:02.728 resquery 0x80281ec00 (fctx 0x8038d7c00(a3-8.tld2/ANY)): send
09-May-2022 16:15:02.728 sending packet to 10.53.0.3#31859
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3478
;; flags: rd; QUESTION: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1084
; COOKIE: e0ad29ea0481b9c30100000062793e05e7d24a8fef7243b5
;; QUESTION SECTION:
;a3-8.tld2. IN ANY
09-May-2022 16:15:02.728 resquery 0x80281ec00 (fctx 0x8038d7c00(a3-8.tld2/ANY)): sent
09-May-2022 16:15:02.728 resquery 0x80281ec00 (fctx 0x8038d7c00(a3-8.tld2/ANY)): senddone
09-May-2022 16:15:03.938 dispatch 0x80252f000: UDP response 0x802c01400:timed out:requests 1
09-May-2022 16:15:03.938 resquery 0x80281ec00 (fctx 0x8038d7c00(a3-8.tld2/ANY)): response
09-May-2022 16:15:03.938 fctx 0x8038d7c00(a3-8.tld2/ANY): timeout
09-May-2022 16:15:03.938 fctx 0x8038d7c00(a3-8.tld2/ANY): query timed out; no response
09-May-2022 16:15:03.938 fctx 0x8038d7c00(a3-8.tld2/ANY): [result: timed out] query canceled in rctx_done(); no response
09-May-2022 16:15:03.938 fctx 0x8038d7c00(a3-8.tld2/ANY): cancelquery
09-May-2022 16:15:03.938 dispatch 0x80252f000: detach: refcount 3
09-May-2022 16:15:03.938 fctx 0x8038d7c00(a3-8.tld2/ANY): resend
09-May-2022 16:15:03.938 fctx 0x8038d7c00(a3-8.tld2/ANY): query
09-May-2022 16:15:03.938 fctx 0x8038d7c00(a3-8.tld2/ANY): timed out
09-May-2022 16:15:03.938 dispatch 0x80252f000: detach: refcount 2
09-May-2022 16:15:03.938 dispatch 0x80252f380: UDP connected (0x802c01200): success
09-May-2022 16:15:03.938 resquery 0x80281ec00 (fctx 0x8038d7c00(a3-8.tld2/ANY)): connected
09-May-2022 16:15:03.938 resquery 0x80281ec00 (fctx 0x8038d7c00(a3-8.tld2/ANY)): send
09-May-2022 16:15:03.938 sending packet to 10.53.0.3#31859
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53246
;; flags: rd; QUESTION: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
; COOKIE: e0ad29ea0481b9c30100000062793e05e7d24a8fef7243b5
;; QUESTION SECTION:
;a3-8.tld2. IN ANY
09-May-2022 16:15:03.938 resquery 0x80281ec00 (fctx 0x8038d7c00(a3-8.tld2/ANY)): sent
09-May-2022 16:15:03.938 resquery 0x80281ec00 (fctx 0x8038d7c00(a3-8.tld2/ANY)): senddone
09-May-2022 16:15:05.149 dispatch 0x80252f380: UDP response 0x802c01200:timed out:requests 1
09-May-2022 16:15:05.149 resquery 0x80281ec00 (fctx 0x8038d7c00(a3-8.tld2/ANY)): response
09-May-2022 16:15:05.149 fctx 0x8038d7c00(a3-8.tld2/ANY): timeout
09-May-2022 16:15:05.149 fctx 0x8038d7c00(a3-8.tld2/ANY): query timed out; no response
09-May-2022 16:15:05.149 fctx 0x8038d7c00(a3-8.tld2/ANY): [result: timed out] query canceled in rctx_done(); no response
09-May-2022 16:15:05.149 fctx 0x8038d7c00(a3-8.tld2/ANY): cancelquery
09-May-2022 16:15:05.149 dispatch 0x80252f380: detach: refcount 2
09-May-2022 16:15:05.149 fctx 0x8038d7c00(a3-8.tld2/ANY): resend
09-May-2022 16:15:05.149 fctx 0x8038d7c00(a3-8.tld2/ANY): query
09-May-2022 16:15:05.149 dispatchmgr 0x801c35850: dns_dispatch_createtcp: created TCP dispatch 0x802ca0540
09-May-2022 16:15:05.149 fctx 0x8038d7c00(a3-8.tld2/ANY): connecting via TCP
09-May-2022 16:15:05.149 fctx 0x8038d7c00(a3-8.tld2/ANY): timed out
09-May-2022 16:15:05.149 dispatch 0x80252f380: detach: refcount 1
09-May-2022 16:15:05.149 dispatch 0x802ca0540: TCP connected (0x802ca0540): success
09-May-2022 16:15:05.149 resquery 0x80281ec00 (fctx 0x8038d7c00(a3-8.tld2/ANY)): connected
09-May-2022 16:15:05.149 resquery 0x80281ec00 (fctx 0x8038d7c00(a3-8.tld2/ANY)): send
09-May-2022 16:15:05.149 sending packet to 10.53.0.3#31859
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 561
;; flags: rd; QUESTION: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
; COOKIE: e0ad29ea0481b9c30100000062793e05e7d24a8fef7243b5
;; QUESTION SECTION:
;a3-8.tld2. IN ANY
09-May-2022 16:15:05.149 resquery 0x80281ec00 (fctx 0x8038d7c00(a3-8.tld2/ANY)): sent
09-May-2022 16:15:05.149 dispatch 0x802ca0540: detach: refcount 3
09-May-2022 16:15:05.149 resquery 0x80281ec00 (fctx 0x8038d7c00(a3-8.tld2/ANY)): senddone
09-May-2022 16:15:06.967 allocate new control connection
09-May-2022 16:15:06.968 received control channel command 'stats'
09-May-2022 16:15:06.968 dumpstats complete
09-May-2022 16:15:06.968 freeing control connection
09-May-2022 16:15:13.527 shut down hung fetch while resolving 'a3-8.tld2/ANY'
09-May-2022 16:15:13.527 fctx 0x8038d7c00(a3-8.tld2/ANY): shutdown
09-May-2022 16:15:13.527 fctx 0x8038d7c00(a3-8.tld2/ANY): posting control event
09-May-2022 16:15:13.527 fctx 0x8038d7c00(a3-8.tld2/ANY): doshutdown
09-May-2022 16:15:13.527 fctx 0x8038d7c00(a3-8.tld2/ANY): cancelqueries
09-May-2022 16:15:13.527 fctx 0x8038d7c00(a3-8.tld2/ANY): cancelquery
09-May-2022 16:15:13.527 dispatch 0x802ca0540: detach: refcount 2
09-May-2022 16:15:13.528 dispatch 0x802ca0540: detach: refcount 1
09-May-2022 16:15:13.528 fctx 0x8038d7c00(a3-8.tld2/ANY): sendevents
09-May-2022 16:15:13.528 fctx 0x8038d7c00(a3-8.tld2/ANY): event
09-May-2022 16:15:13.528 query client=0x802559160 thread=0x801c13400(a3-8.tld2/ANY): fetch_callback
09-May-2022 16:15:13.528 query client=0x802559160 thread=0x801c13400(a3-8.tld2/ANY): qctx_init
09-May-2022 16:15:13.528 dispatch 0x802ca0540: TCP read:end of file:requests 0, buffers 0
09-May-2022 16:15:13.528 query client=0x802559160 thread=0x801c13400(a3-8.tld2/ANY): client attr:0x2103, query attr:0x3303, restarts:0, origqname:a3-8.tld2, timer:0, authdb:1, referral:0
09-May-2022 16:15:13.528 dispatch 0x802ca0540: shutting down TCP: 10.53.0.3#31859: end of file
09-May-2022 16:15:13.528 dispatch 0x802ca0540: detach: refcount 0
09-May-2022 16:15:13.528 dispatch 0x802ca0540: shutting down; detaching from handle 0x802492c80
09-May-2022 16:15:13.528 query client=0x802559160 thread=0x801c13400(a3-8.tld2/ANY): query_resume
09-May-2022 16:15:13.528 query client=0x802559160 thread=0x801c13400(a3-8.tld2/ANY): resume from normal recursion
09-May-2022 16:15:13.528 query client=0x802559160 thread=0x801c13400(a3-8.tld2/ANY): query_gotanswer
09-May-2022 16:15:13.528 client @0x802559160 10.53.0.6#43512 (a3-8.tld2): rrl=0x0, HAVECOOKIE=0, result=ISC_R_CANCELED, fname=0x8024ead80(0), is_zone=0, RECURSIONOK=1, query.rpz_st=0x802503800(0), RRL_CHECKED=0
09-May-2022 16:15:13.528 query client=0x802559160 thread=0x801c13400(a3-8.tld2/ANY): query_checkrpz
09-May-2022 16:15:13.528 query client=0x802559160 thread=0x801c13400(a3-8.tld2/ANY): rpz_rewrite
09-May-2022 16:15:13.528 query client=0x802559160 thread=0x801c13400(a3-8.tld2/ANY): rpz_ck_dnssec
09-May-2022 16:15:13.528 client @0x802559160 10.53.0.6#43512 (a3-8.tld2): rpz QNAME rewrite a3-8.tld2 stop on unrecognized qresult in rpz_rewrite() failed: operation canceled
09-May-2022 16:15:13.528 query client=0x802559160 thread=0x801c13400(a3-8.tld2/ANY): query_gotanswer: unexpected error: operation canceled
09-May-2022 16:15:13.528 query client=0x802559160 thread=0x801c13400(a3-8.tld2/ANY): free_devent
09-May-2022 16:15:13.528 query client=0x802559160 thread=0x801c13400(a3-8.tld2/ANY): ns_query_done
09-May-2022 16:15:13.528 client @0x802559160 10.53.0.6#43512 (a3-8.tld2): query failed (operation canceled) for a3-8.tld2/IN/ANY at query.c:7715
09-May-2022 16:15:13.528 fetch completed at resolver.c:4523 for a3-8.tld2/ANY in 12.001602: operation canceled/success [domain:tld2,referral:0,restart:1,qrysent:4,timeout:3,lame:0,quota:0,neterr:0,badresp:0,adberr:0,findfail:0,valfail:0]
09-May-2022 16:15:13.528 fetch 0x802c1c080 (fctx 0x8038d7c00(a3-8.tld2/ANY)): destroyfetch
09-May-2022 16:15:13.528 fctx 0x8038d7c00(a3-8.tld2/ANY): destroy
09-May-2022 16:15:13.528 res 0x8024e40c0: detach
09-May-2022 16:15:13.528 res 0x8024e40c0: detach
09-May-2022 16:15:13.528 client @0x802559160 10.53.0.6#43512 (a3-8.tld2): send failed: operation canceled
09-May-2022 16:15:13.528 client @0x802559160 10.53.0.6#43512 (a3-8.tld2): reset client
09-May-2022 16:15:13.528 query client=0x802559160 thread=0x801c13400(a3-8.tld2/ANY): query_reset
09-May-2022 16:15:13.528 query client=0x802559160 thread=0x801c13400(<unknown-query>): rpz_st_clear
09-May-2022 16:15:13.528 client @0x802559160 10.53.0.6#43512: freeing client
09-May-2022 16:15:13.528 query client=0x802559160 thread=0x801c13400(<unknown-query>): query_reset
09-May-2022 16:15:13.528 query client=0x802559160 thread=0x801c13400(<unknown-query>): rpz_st_clear
09-May-2022 16:15:13.528 clientmgr @0x8024c8000 detach: 2
```
</details>Not plannedhttps://gitlab.isc.org/isc-projects/bind9/-/issues/3339Small zone update took 13 seconds to complete2022-05-31T14:52:14ZMichal NowakSmall zone update took 13 seconds to complete`dnssec:checking that the NSEC3 record for the apex is properly signed when a DNSKEY is added via UPDATE` system test [failed](https://gitlab.isc.org/isc-private/bind9/-/jobs/2500940) with:
```
I:dnssec:checking that the NSEC3 record for...`dnssec:checking that the NSEC3 record for the apex is properly signed when a DNSKEY is added via UPDATE` system test [failed](https://gitlab.isc.org/isc-private/bind9/-/jobs/2500940) with:
```
I:dnssec:checking that the NSEC3 record for the apex is properly signed when a DNSKEY is added via UPDATE (159)
; Communication with 10.53.0.3#30812 failed: timed out
I:dnssec:stopping servers
R:dnssec:FAIL
E:dnssec:2022-05-09T09:25:06+0000
FAIL dnssec (exit status: 2)
```
`Communication with 10.53.0.3#30812 failed: timed out` comes from this `nsupdate` code:
```
(
echo zone update-nsec3.example
echo server 10.53.0.3 "$PORT"
grep DNSKEY "${kskname}.key" | sed -e 's/^/update add /' -e 's/IN/300 IN/'
echo send
) | $NSUPDATE
```
The default `nsupdate` timeout is 12 second:
```
$ time ( echo -e "zone update-nsec3.example\nserver 10.53.0.3 12345\nsend" | nsupdate )
; Communication with 10.53.0.3#12345 failed: timed out
real 0m12.040s
```
According to `ns3/named.run` it seems that the zone update took 13 seconds to complete/fail (`send failed: operation canceled`):
```
09-May-2022 09:24:51.064 clientmgr @0x60c000006700 attach: 2
09-May-2022 09:24:51.064 query client=0x61f000151c80 thread=0x7f23f7f62640(<unknown-query>): query_reset
09-May-2022 09:24:51.064 client @0x61f000151c80 (no-peer): allocate new client
09-May-2022 09:24:51.064 client @0x61f000151c80 10.53.0.1#49014: UDP request
09-May-2022 09:24:51.064 client @0x61f000151c80 10.53.0.1#49014: using view '_default'
09-May-2022 09:24:51.064 client @0x61f000151c80 10.53.0.1#49014: request is not signed
09-May-2022 09:24:51.064 client @0x61f000151c80 10.53.0.1#49014: recursion not available
09-May-2022 09:24:51.064 client @0x61f000151c80 10.53.0.1#49014: updating zone 'update-nsec3.example/IN': prerequisites are OK
09-May-2022 09:24:51.064 client @0x61f000151c80 10.53.0.1#49014: update 'update-nsec3.example/IN' approved
09-May-2022 09:24:51.064 client @0x61f000151c80 10.53.0.1#49014: updating zone 'update-nsec3.example/IN': update section prescan OK
09-May-2022 09:24:51.064 client @0x61f000151c80 10.53.0.1#49014: updating zone 'update-nsec3.example/IN': adding an RR at 'update-nsec3.example' DNSKEY 257 3 7 AwEAAcMtKfINfZtuWA/i2KM2Ppi7pRaUOzARZhOYUGjOojSvPyhAWOXh t7GjbITaUQH7tKEyEK0ZD2OshdnqEu4+6hW3cLaKlgTYxJX86++zqnJb eEhtz9ARhyKGIE02kNMjFhAh7wkn33VcV7bQzLjf5jJsNi5+5FioxEXr sGPMoB+7k/Cq+GvNRVyQCosMhvE517osbEOyh5RLRGuDGs789wSSH/IW fOPoZunJxrEvs8wehrnMDyA4zdOCpxmQs1VygFX4NeVoyLRVKwGyfHy0 vyrJHTVs8BRM1nNsOMZpCtZWPQRX828tPV9yyMUqU6ERxWdUf5a3l2fi 6DVYcb1N278=
09-May-2022 09:24:51.064 client @0x61f000151c80 10.53.0.1#49014: updating zone 'update-nsec3.example/IN': checking for NSEC3PARAM changes
09-May-2022 09:24:51.068 client @0x61f000151c80 10.53.0.1#49014: updating zone 'update-nsec3.example/IN': updated data signatures
09-May-2022 09:24:51.068 client @0x61f000151c80 10.53.0.1#49014: updating zone 'update-nsec3.example/IN': removed any orphaned NSEC records
09-May-2022 09:24:51.068 client @0x61f000151c80 10.53.0.1#49014: updating zone 'update-nsec3.example/IN': rebuilding NSEC3 chains
09-May-2022 09:24:51.068 client @0x61f000151c80 10.53.0.1#49014: updating zone 'update-nsec3.example/IN': signing rebuilt NSEC3 chain
09-May-2022 09:24:51.068 client @0x61f000151c80 10.53.0.1#49014: updating zone 'update-nsec3.example/IN': writing journal update-nsec3.example.db.signed.jnl
09-May-2022 09:24:51.068 journal file update-nsec3.example.db.signed.jnl does not exist, creating it
09-May-2022 09:24:51.068 writing to journal
09-May-2022 09:24:51.068 del update-nsec3.example. 300 IN SOA mname1. . 2000042407 20 20 1814400 3600
09-May-2022 09:24:51.068 del update-nsec3.example. 300 IN RRSIG SOA 13 2 300 20220608082241 20220509082241 14802 update-nsec3.example. SijqLjgxJdEDXVtpjheS8LkNBb5AgbPFLVNagGBpm9sMyvtNiNxjoV+V jETZDUkRJMjFTiItYhawE55ws+K6og==
09-May-2022 09:24:51.068 del update-nsec3.example. 300 IN RRSIG DNSKEY 13 2 300 20220608082241 20220509082241 14802 update-nsec3.example. GGF25XNZQU1G4sNDpbP8LbDDN7h7Bq1MQ/JfCp0mUjAemkTYUmj2+wGd kdyk3lOvIDo4Po8gCV6KLLe0hQJwBw==
09-May-2022 09:24:51.068 del update-nsec3.example. 300 IN RRSIG DNSKEY 13 2 300 20220608082241 20220509082241 25481 update-nsec3.example. 9YjF2dDh+2ryxCYLtBpB1uQor8zv7YUUXJV1vZwztoOEG3V6tVO6SLp2 0Mo3xguexDWJUpQMcbRL1AnMtuxWyA==
09-May-2022 09:24:51.068 del B8V5JKM06MQ7LQCJ60FGESOBNV5MCNUH.update-nsec3.example. 300 IN RRSIG NSEC3 13 3 300 20220608082241 20220509082241 14802 update-nsec3.example. MnwzTiwzEmxRM+ebwBskZQz7pKk+Tyunv0QXgwfRVtvvO6BsqfAi1OBG I9PL7mKijThyEw2ZHiSk4rZ8JtqoVg==
09-May-2022 09:24:51.068 del B8V5JKM06MQ7LQCJ60FGESOBNV5MCNUH.update-nsec3.example. 300 IN NSEC3 1 0 10 - B9VFOBC8CSPMRSJC47TM47PIPT9HENS9 NS SOA RRSIG DNSKEY NSEC3PARAM
09-May-2022 09:24:51.068 add update-nsec3.example. 300 IN SOA mname1. . 2000042408 20 20 1814400 3600
09-May-2022 09:24:51.068 add re-sign update-nsec3.example. 300 IN RRSIG SOA 7 2 300 20220608092451 20220509082451 2148 update-nsec3.example. NrdVuqNT17I05O4oaUYnQf8qNXYb9PitF2xgQnhc6oJLnEwGQ+LGskOF epLpJsnVxW4z4ZT6Xy9n/Ynd6V+duug9R0sPdEBOTvCWiXb+mpjMQxQL /7gncZFKMN72g7RiaYBgC2u7R+ha0efippyur10OMuPRWvz0t2CDRLVE JfyGXWnWWZFAMhoEHOAJsghU1i8MFs4SM3cOndJEh0p5PT1jU0wo6/hS pyUWmR27eDrAYsrxd/ZChVkicYhpA8eChb6xHRYk3/Ui8cEYqh8p2N8n BDy+92vNMWFO3aCYDX4f0FRwbzMpZ5rtKBNxRnw6NhD+3bgGJUV8a8Od QxbWBA==
09-May-2022 09:24:51.068 add re-sign update-nsec3.example. 300 IN RRSIG SOA 13 2 300 20220608092451 20220509082451 14802 update-nsec3.example. MVXp+aeCkf3OC3ncn0UxHSRQp7WXCpmOg4FhG6iRkEnCENHTpPnPo5BQ nhtQ+Z67yoCuQcAEn36l5nuOaO03KA==
09-May-2022 09:24:51.068 add re-sign update-nsec3.example. 300 IN RRSIG DNSKEY 7 2 300 20220605041617 20220509082451 2148 update-nsec3.example. qInTflpkllghyHsC77oDG4BvMLlScV8te5NFgWi2L6VFmkrvgQHV0bob bK5+ItF8erMOBUqLb+ljW9aJkmmriy6pUT4e4e442LTkquuB3FkaOQaN Mv2ivjlEVKvF3o426eYL1cLb9+jd4WHpJsOajmy9nJ3xr9GlcWNLldUo PCMdXMU1bTk86wVa40MKxuFEK4M+PUiGx8FoWSweI2JBjzUcDqCNUU23 dFZ3r8TyQXPK8wNWOLUukHbAenCRYFsC8u5Cfey3fjU43vQigM3U9jHH dWQsSVyo6/Kr7LqWMye+xppO2qCVHd4FSif5ZwTMR2D3c1GFpG7CH7s9 byOS/A==
09-May-2022 09:24:51.068 add re-sign update-nsec3.example. 300 IN RRSIG DNSKEY 13 2 300 20220605041617 20220509082451 25481 update-nsec3.example. R7kmOVYTkWQnvCL40MsDLNlAKRy90Qe3zxnuCcirNWPkT80WjLZvnZX7 yRwnd5dfze7FgJGus72hDL1oiAKGdw==
09-May-2022 09:24:51.068 add re-sign update-nsec3.example. 0 IN RRSIG TYPE65534 7 2 0 20220605041617 20220509082451 2148 update-nsec3.example. OLuKSExxvWIqBSoe6NsVx/2gBJWvMfDDfav0ot2ujN7d3GQNAdjFWM5S yvPrzUQzLgeuDqqQ3de0kpnynQGOMHS+STsHaIrq817+F2GIhOmN98cS HNUSoc7HVcD6XqTun4JVTYPM2brA80LdtROj56ZV/7Zq/F4W8IDySMDy FMJQzL2BwkkhRTKpswMZqhlal3VYCJosWC5YX5FwvQ/N9tjY0n9mCRYe xo2whWjl17ESXapHcCKxcOnHKHc1XMkYUlyNuTxnlqiyITAKFAavv/+f weV+LuhDKXVk+7U3qpl8Ef52qdskwUIc7Gguxw+1wZXeDB2aszex78n7 RufmJA==
09-May-2022 09:24:51.068 add re-sign update-nsec3.example. 0 IN RRSIG TYPE65534 13 2 0 20220605041617 20220509082451 14802 update-nsec3.example. okd7cM0dOW7e2NEDtVED/8rB7o5N2n09DvStk7vu7raLosLbJxz/tz1K NQj5/A0FtolGSNsJSYSc5ApDhzt9vw==
09-May-2022 09:24:51.068 add re-sign B8V5JKM06MQ7LQCJ60FGESOBNV5MCNUH.update-nsec3.example. 300 IN RRSIG NSEC3 13 3 300 20220605041617 20220509082451 14802 update-nsec3.example. KH+YTWy3JSPjjAdZfwRn4qxMl4pJRdzM+n/DZvKGZ4Qv7hFMVSEjeCxJ XKbjqz2QmtVX3F5RILO+GA9inhNYMg==
09-May-2022 09:24:51.068 add re-sign B8V5JKM06MQ7LQCJ60FGESOBNV5MCNUH.update-nsec3.example. 300 IN RRSIG NSEC3 7 3 300 20220605041617 20220509082451 2148 update-nsec3.example. TgIZzfZ9pYENI7pFdydADeNg2W/wMdFJcLYFrU5RFyppHn6lK1HikskK AU7YtSR9+NDzlZjp6gCxPXr56if8ARXbwOhHRMBWR26xfdwlq36FizWp mM0j91tjXwmyLVsmppxw+SCURq1k6mpq+I9ZN856vrswLVHEf2bpq2pe LC+9gt3x4aeVdMuyS4yel5YeIRgNmZ3kiL4RkXWA8xiXWAOfnVl3Vrtt aJu0M+LouFr/ICzKwHFlfS2p/uYS8XwOJhywSHKueLHGAlrA0G1u9iGW of1N/8omkT7NVf43tFjc+m9ANmmHVhRhe+g/zpzzoIorMIB/R2c+gSmk DWDhWA==
09-May-2022 09:24:51.068 add update-nsec3.example. 300 IN DNSKEY 257 3 7 AwEAAcMtKfINfZtuWA/i2KM2Ppi7pRaUOzARZhOYUGjOojSvPyhAWOXh t7GjbITaUQH7tKEyEK0ZD2OshdnqEu4+6hW3cLaKlgTYxJX86++zqnJb eEhtz9ARhyKGIE02kNMjFhAh7wkn33VcV7bQzLjf5jJsNi5+5FioxEXr sGPMoB+7k/Cq+GvNRVyQCosMhvE517osbEOyh5RLRGuDGs789wSSH/IW fOPoZunJxrEvs8wehrnMDyA4zdOCpxmQs1VygFX4NeVoyLRVKwGyfHy0 vyrJHTVs8BRM1nNsOMZpCtZWPQRX828tPV9yyMUqU6ERxWdUf5a3l2fi 6DVYcb1N278=
09-May-2022 09:24:51.068 add B8V5JKM06MQ7LQCJ60FGESOBNV5MCNUH.update-nsec3.example. 300 IN NSEC3 1 0 10 - B9VFOBC8CSPMRSJC47TM47PIPT9HENS9 NS SOA RRSIG DNSKEY NSEC3PARAM TYPE65534
09-May-2022 09:24:51.068 add update-nsec3.example. 0 IN TYPE65534 \# 5 0708640000
09-May-2022 09:24:54.068 clientmgr @0x60c000006700 attach: 3
09-May-2022 09:24:54.716 query client=0x61f000152a80 thread=0x7f23f7f62640(<unknown-query>): query_reset
09-May-2022 09:24:54.716 client @0x61f000152a80 (no-peer): allocate new client
09-May-2022 09:24:54.716 client @0x61f000152a80 10.53.0.1#49014: UDP request
09-May-2022 09:24:54.716 client @0x61f000152a80 10.53.0.1#49014: using view '_default'
09-May-2022 09:24:54.716 client @0x61f000152a80 10.53.0.1#49014: request is not signed
09-May-2022 09:24:54.716 client @0x61f000152a80 10.53.0.1#49014: recursion not available
09-May-2022 09:24:57.072 clientmgr @0x60c000006700 attach: 4
09-May-2022 09:24:57.072 query client=0x61f000153880 thread=0x7f23f7f62640(<unknown-query>): query_reset
09-May-2022 09:24:57.072 client @0x61f000153880 (no-peer): allocate new client
09-May-2022 09:24:57.072 client @0x61f000153880 10.53.0.1#49014: UDP request
09-May-2022 09:24:57.072 client @0x61f000153880 10.53.0.1#49014: using view '_default'
09-May-2022 09:24:57.072 client @0x61f000153880 10.53.0.1#49014: request is not signed
09-May-2022 09:24:57.072 client @0x61f000153880 10.53.0.1#49014: recursion not available
09-May-2022 09:25:00.076 clientmgr @0x60c000006700 attach: 5
09-May-2022 09:25:00.076 query client=0x61f000154680 thread=0x7f23f7f62640(<unknown-query>): query_reset
09-May-2022 09:25:00.076 client @0x61f000154680 (no-peer): allocate new client
09-May-2022 09:25:00.076 client @0x61f000154680 10.53.0.1#49014: UDP request
09-May-2022 09:25:00.076 client @0x61f000154680 10.53.0.1#49014: using view '_default'
09-May-2022 09:25:00.076 client @0x61f000154680 10.53.0.1#49014: request is not signed
09-May-2022 09:25:00.076 client @0x61f000154680 10.53.0.1#49014: recursion not available
09-May-2022 09:25:03.120 no longer listening on 10.53.0.3#30812
09-May-2022 09:25:04.108 client @0x61f000151c80 10.53.0.1#49014: updating zone 'update-nsec3.example/IN': committing update transaction
09-May-2022 09:25:04.108 zone_settimer: zone update-nsec3.example/IN: enter
09-May-2022 09:25:04.108 zone_needdump: zone update-nsec3.example/IN: enter
09-May-2022 09:25:04.108 zone_settimer: zone update-nsec3.example/IN: enter
09-May-2022 09:25:04.108 zone_settimer: zone update-nsec3.example/IN: enter
09-May-2022 09:25:04.108 zone update-nsec3.example/IN: dns_zone_signwithkey(algorithm=7, keyid=2148)
09-May-2022 09:25:04.108 zone_settimer: zone update-nsec3.example/IN: enter
09-May-2022 09:25:04.108 client @0x61f000152a80 10.53.0.1#49014: updating zone 'update-nsec3.example/IN': prerequisites are OK
09-May-2022 09:25:04.108 client @0x61f000152a80 10.53.0.1#49014: update 'update-nsec3.example/IN' approved
09-May-2022 09:25:04.108 client @0x61f000152a80 10.53.0.1#49014: updating zone 'update-nsec3.example/IN': update section prescan OK
09-May-2022 09:25:04.108 client @0x61f000152a80 10.53.0.1#49014: updating zone 'update-nsec3.example/IN': adding an RR at 'update-nsec3.example' DNSKEY 257 3 7 AwEAAcMtKfINfZtuWA/i2KM2Ppi7pRaUOzARZhOYUGjOojSvPyhAWOXh t7GjbITaUQH7tKEyEK0ZD2OshdnqEu4+6hW3cLaKlgTYxJX86++zqnJb eEhtz9ARhyKGIE02kNMjFhAh7wkn33VcV7bQzLjf5jJsNi5+5FioxEXr sGPMoB+7k/Cq+GvNRVyQCosMhvE517osbEOyh5RLRGuDGs789wSSH/IW fOPoZunJxrEvs8wehrnMDyA4zdOCpxmQs1VygFX4NeVoyLRVKwGyfHy0 vyrJHTVs8BRM1nNsOMZpCtZWPQRX828tPV9yyMUqU6ERxWdUf5a3l2fi 6DVYcb1N278=
09-May-2022 09:25:04.108 client @0x61f000152a80 10.53.0.1#49014: updating zone 'update-nsec3.example/IN': redundant request
09-May-2022 09:25:04.108 client @0x61f000153880 10.53.0.1#49014: updating zone 'update-nsec3.example/IN': prerequisites are OK
09-May-2022 09:25:04.108 client @0x61f000153880 10.53.0.1#49014: update 'update-nsec3.example/IN' approved
09-May-2022 09:25:04.108 client @0x61f000153880 10.53.0.1#49014: updating zone 'update-nsec3.example/IN': update section prescan OK
09-May-2022 09:25:04.108 client @0x61f000153880 10.53.0.1#49014: updating zone 'update-nsec3.example/IN': adding an RR at 'update-nsec3.example' DNSKEY 257 3 7 AwEAAcMtKfINfZtuWA/i2KM2Ppi7pRaUOzARZhOYUGjOojSvPyhAWOXh t7GjbITaUQH7tKEyEK0ZD2OshdnqEu4+6hW3cLaKlgTYxJX86++zqnJb eEhtz9ARhyKGIE02kNMjFhAh7wkn33VcV7bQzLjf5jJsNi5+5FioxEXr sGPMoB+7k/Cq+GvNRVyQCosMhvE517osbEOyh5RLRGuDGs789wSSH/IW fOPoZunJxrEvs8wehrnMDyA4zdOCpxmQs1VygFX4NeVoyLRVKwGyfHy0 vyrJHTVs8BRM1nNsOMZpCtZWPQRX828tPV9yyMUqU6ERxWdUf5a3l2fi 6DVYcb1N278=
09-May-2022 09:25:04.108 client @0x61f000153880 10.53.0.1#49014: updating zone 'update-nsec3.example/IN': redundant request
09-May-2022 09:25:04.108 client @0x61f000154680 10.53.0.1#49014: updating zone 'update-nsec3.example/IN': prerequisites are OK
09-May-2022 09:25:04.108 client @0x61f000151c80 10.53.0.1#49014: send failed: operation canceled
09-May-2022 09:25:04.108 client @0x61f000154680 10.53.0.1#49014: update 'update-nsec3.example/IN' approved
09-May-2022 09:25:04.108 client @0x61f000151c80 10.53.0.1#49014: reset client
09-May-2022 09:25:04.108 client @0x61f000154680 10.53.0.1#49014: updating zone 'update-nsec3.example/IN': update section prescan OK
09-May-2022 09:25:04.108 client @0x61f000151c80 10.53.0.1#49014: freeing client
09-May-2022 09:25:04.108 query client=0x61f000151c80 thread=0x7f23f7f62640(<unknown-query>): query_reset
09-May-2022 09:25:04.108 client @0x61f000154680 10.53.0.1#49014: updating zone 'update-nsec3.example/IN': adding an RR at 'update-nsec3.example' DNSKEY 257 3 7 AwEAAcMtKfINfZtuWA/i2KM2Ppi7pRaUOzARZhOYUGjOojSvPyhAWOXh t7GjbITaUQH7tKEyEK0ZD2OshdnqEu4+6hW3cLaKlgTYxJX86++zqnJb eEhtz9ARhyKGIE02kNMjFhAh7wkn33VcV7bQzLjf5jJsNi5+5FioxEXr sGPMoB+7k/Cq+GvNRVyQCosMhvE517osbEOyh5RLRGuDGs789wSSH/IW fOPoZunJxrEvs8wehrnMDyA4zdOCpxmQs1VygFX4NeVoyLRVKwGyfHy0 vyrJHTVs8BRM1nNsOMZpCtZWPQRX828tPV9yyMUqU6ERxWdUf5a3l2fi 6DVYcb1N278=
09-May-2022 09:25:04.108 client @0x61f000154680 10.53.0.1#49014: updating zone 'update-nsec3.example/IN': redundant request
09-May-2022 09:25:04.108 clientmgr @0x60c000006700 detach: 4
09-May-2022 09:25:04.108 client @0x61f000152a80 10.53.0.1#49014: send failed: operation canceled
09-May-2022 09:25:04.108 client @0x61f000152a80 10.53.0.1#49014: reset client
09-May-2022 09:25:04.108 client @0x61f000152a80 10.53.0.1#49014: freeing client
09-May-2022 09:25:04.108 query client=0x61f000152a80 thread=0x7f23f7f62640(<unknown-query>): query_reset
09-May-2022 09:25:04.108 clientmgr @0x60c000006700 detach: 3
09-May-2022 09:25:04.108 exclusive task mode: starting
09-May-2022 09:25:04.108 client @0x61f000153880 10.53.0.1#49014: send failed: operation canceled
09-May-2022 09:25:04.108 client @0x61f000153880 10.53.0.1#49014: reset client
09-May-2022 09:25:04.108 client @0x61f000153880 10.53.0.1#49014: freeing client
09-May-2022 09:25:04.108 query client=0x61f000153880 thread=0x7f23f7f62640(<unknown-query>): query_reset
09-May-2022 09:25:04.108 clientmgr @0x60c000006700 detach: 2
09-May-2022 09:25:04.108 client @0x61f000154680 10.53.0.1#49014: send failed: operation canceled
09-May-2022 09:25:04.108 client @0x61f000154680 10.53.0.1#49014: reset client
09-May-2022 09:25:04.108 client @0x61f000154680 10.53.0.1#49014: freeing client
09-May-2022 09:25:04.108 query client=0x61f000154680 thread=0x7f23f7f62640(<unknown-query>): query_reset
09-May-2022 09:25:04.108 clientmgr @0x60c000006700 detach: 1
```
The system was likely heavily overloaded as this action takes sub 100 ms on my Linux laptop.Not plannedhttps://gitlab.isc.org/isc-projects/bind9/-/issues/3338zero system test fails often2022-10-05T08:30:56ZMichal Nowakzero system test fails oftenThe `zero:check lookups against TTL=0 records` system test [fails](https://gitlab.isc.org/isc-private/bind9/-/jobs/2500945) fairly often on `main` and `v9_18` in the CI (tho I was unable to reproduce it locally):
```
I:zero:check lookups...The `zero:check lookups against TTL=0 records` system test [fails](https://gitlab.isc.org/isc-private/bind9/-/jobs/2500945) fairly often on `main` and `v9_18` in the CI (tho I was unable to reproduce it locally):
```
I:zero:check lookups against TTL=0 records (1)
I:zero:failed
```
Looking at the code there are two possibilities to fail the test code:
1. Either of six `dig -f query.list` instances fails to finish in 69 seconds (`timeout=$(($(wc -l < query.list) / 5))`), or
2. `status: SERVFAIL` is identified in `dig` stdout logs (`dig.out$i.[1-6].test$n`).
Looking at `dig.out$i.[1-6].test$n` logs I am certain that they don't contain `status: SERVFAIL` for any query from the `query.list` file. Perhaps one of six `dig -f query.list` instances is stuck, waiting for being collected by `kill -TERM "$pid1" ...` and `wait "$pid1" || ret=1`?Not planned