<div dir="ltr"><div><div><div><div>Hi Cliff,<br><br></div><div>If you haven't already got things worked out, mind if I take a step back and make sure I understand the problem you're trying to solve?<br></div><br></div>
Am I correct that you're looking for your DNS server to only answer queries (successfully, anyhow) for records that are in your database? And you want everything else to return NXDOMAIN? REFUSED? Something else?<br>
</div><div><br></div><div>John<br></div><div><br></div></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Sep 3, 2013 at 3:30 PM, Cliff Hayes <span dir="ltr"><<a href="mailto:chayes@afo.net" target="_blank">chayes@afo.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">More details as requested:<br>
<br>
I am currently running both of the following on the same server running Scientific Linux 6.4:<br>
PowerDNS Authoritative Server 3.3<br>
PowerDNS recursor 3.5.2<br>
I have an empty hint file because I want all requests to fail except for what I have in the pdns database.<br>
<br>
pdns.conf has the defaults with these mods:<br>
launch=gmysql<br>
gmysql-host=127.0.0.1<br>
gmysql-user=pdns<br>
gmysql-dbname=pdns<br>
gmysql-password=xxxxxx<br>
log-dns-details=yes<br>
log-failed-updates=yes<br>
logging-facility=0<br>
loglevel=9<br>
query-logging=yes<br>
recursor=<a href="http://127.0.0.1:54" target="_blank">127.0.0.1:54</a><br>
master=yes<br>
max-tcp-connections=100<br>
<br>
recursor.conf has the defaults with these mods:<br>
etc-hosts-file=/scripts/pdns.<u></u>hosts<br>
hint-file=/scripts/pdns.hint<br>
local-port=54<br>
logging-facility=0<br>
lua-dns-script=/scripts/pdns.<u></u>lua<br>
trace=on<br>
<br>
pdns.lua looks like this (translateQtype removed for brevity):<br>
function preresolve ( remoteip, domain, qtype )<br>
pdnslog("debug1")<br>
pdnslog("preresolve debug remoteip: ["..remoteip.."] local address: ["..getlocaladdress().."] type: ["..translateQtype(qtype).."]"<u></u>)<br>
return -1, {}<br>
end<br>
<br>
function nxdomain ( ip, destination, domain, qtype )<br>
pdnslog("debug2")<br>
return -1, {}<br>
end<br>
<br>
function nodata ( remoteip, domain, qtype, records )<br>
pdnslog("debug3")<br>
return -1, {}<br>
end<br>
<br>
function postresolve ( remoteip, domain, qtype, records, origrcode )<br>
pdnslog("debug4")<br>
pdnslog("postresolve debug remoteip: ["..remoteip.."] getlocaladress: ["..getlocaladdress().."] domain: ["..domain.."] type: ["..translateQtype(qtype).."] origrcode: ["..origrcode.."]")<br>
return -1, {}<br>
end<br>
<br>
function prequery ( dnspacket )<br>
pdnslog("debug5")<br>
return -1, {}<br>
end<br>
<br>
domains table contents:<br>
mysql> select * from domains;<br>
+----+---------+--------+-----<u></u>-------+--------+-------------<u></u>----+---------+<br>
| id | name | master | last_check | type | notified_serial | account |<br>
+----+---------+--------+-----<u></u>-------+--------+-------------<u></u>----+---------+<br>
| 1 | <a href="http://cnn.com" target="_blank">cnn.com</a> | NULL | NULL | NATIVE | NULL | NULL |<br>
+----+---------+--------+-----<u></u>-------+--------+-------------<u></u>----+---------+<br>
<br>
records table contents:<br>
| id | domain_id | name | type | content | ttl | prio | change_date |<br>
+----+-----------+---------+--<u></u>----+-------------------------<u></u>---+-------+------+-----------<u></u>--+<br>
| 1 | 1 | <a href="http://cnn.com" target="_blank">cnn.com</a> | SOA | localhost dnsadm@xxx.yyy 1 | 86400 | NULL | NULL |<br>
| 2 | 1 | <a href="http://cnn.com" target="_blank">cnn.com</a> | NS | ns1.xxx.yyy | 86400 | NULL | NULL |<br>
| 3 | 1 | <a href="http://cnn.com" target="_blank">cnn.com</a> | NS | ns2.xxx.yyy | 86400 | NULL | NULL |<br>
| 4 | 1 | <a href="http://cnn.com" target="_blank">cnn.com</a> | A | ww.xx.yy.zz | 120 | NULL | NULL |<br>
+----+-----------+---------+--<u></u>----+-------------------------<u></u>---+-------+------+-----------<u></u>--+<br>
<br>
<br>
The pdns.hosts and pdns.hint files are blank on purpose because I am trying to build a whitelist dns.<br>
My two problems are:<br>
a) wildcard doesn't work so I can't whitelist domains ... I would have to have a record for every subdomain (see logs below)<br>
b) I can't get nxdomain to work. I only see debug1 and debug4 in the logs ... nxdomain is not running for some reason. I'm assuming I need to put something in nxdomain to redirect users to a block page for domains that are not whitelisted.<br>
<br>
Logs show NS lookup occurring at the subdomain level instead of domain level (I realize other domains would have to be added in order to get cnn to work ... this is just for illustration):<br>
<br>
Sep 3 14:23:40 volon pdns[1520]: Query: select content,ttl,prio,type,domain_<u></u>id,name from records where type='SOA' and name='<a href="http://www.cnn.com" target="_blank">www.cnn.com</a>'<br>
Sep 3 14:23:40 volon pdns[1520]: Query: select content,ttl,prio,type,domain_<u></u>id,name from records where type='SOA' and name='<a href="http://cnn.com" target="_blank">cnn.com</a>'<br>
Sep 3 14:23:40 volon pdns[1520]: Query: select content,ttl,prio,type,domain_<u></u>id,name from records where type='NS' and name='<a href="http://www.cnn.com" target="_blank">www.cnn.com</a>' and domain_id=1<br>
Sep 3 14:23:40 volon pdns[1520]: Query: select content,ttl,prio,type,domain_<u></u>id,name from records where name='<a href="http://www.cnn.com" target="_blank">www.cnn.com</a>' and domain_id=1<br>
Sep 3 14:23:40 volon pdns[1520]: Query: select content,ttl,prio,type,domain_<u></u>id,name from records where name='*.<a href="http://cnn.com" target="_blank">cnn.com</a>' and domain_id=1<br>
<br>
<br>
<br>
On 9/3/2013 1:02 PM, John Miller wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On 09/03/2013 01:56 PM, chayes wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I am trying to get wildcard working.<br>
I notice that pdns is querying the database looking for NS records at the<br>
subdomain level, which I did not expect.<br>
I have only seen NS records exist at the domain level and that is how our<br>
DNS server is set up.<br>
This behavior is preventing me from being able to implement wildcard<br>
subdomain.<br>
How can I get pdns to look for A records at the subdomain level, and<br>
everything else at the domain level?<br>
</blockquote>
<br>
Could you please post some examples of what's going on here, as well as your configuration?<br>
<br>
John<br>
<br>
______________________________<u></u>_________________<br>
Pdns-users mailing list<br>
<a href="mailto:Pdns-users@mailman.powerdns.com" target="_blank">Pdns-users@mailman.powerdns.<u></u>com</a><br>
<a href="http://mailman.powerdns.com/mailman/listinfo/pdns-users" target="_blank">http://mailman.powerdns.com/<u></u>mailman/listinfo/pdns-users</a><br>
<br>
</blockquote>
<br>
</blockquote></div><br><br clear="all"><br>-- <br>John Miller<br>Systems Engineer<br>Brandeis University<br><a href="mailto:johnmill@brandeis.edu">johnmill@brandeis.edu</a><br>(781) 736-4619
</div>