LUA zone apex setup issues

[joachimtingvold]

I attempted to implement the workaround LUA zone apex setup mentioned in #3838, and followed the example here, but I'm having a hard time getting it to work.

Setup consists of three servers;

• authdns-master (hidden master)
• authdns1 (slave)
• authdns2 (slave)

enable-lua-records=yes is set on all three servers. I can query for the LUA record on authdns-master just fine;

root@authdns-master:~# dig @localhost as60163.net a

; <<>> DiG 9.16.42-Debian <<>> @localhost as60163.net a
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27538
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;as60163.net.           IN  A

;; ANSWER SECTION:
as60163.net.        3600    IN  A   185.54.28.70

;; Query time: 0 msec
;; SERVER: ::1#53(::1)
;; WHEN: Mon Sep 11 15:08:09 CEST 2023
;; MSG SIZE  rcvd: 56

If I enable debug on authdns-master, I see the following;

Sep 11 15:08:09 authdns-master pdns_server[178900]: Remote 2001:<snip> wants 'as60163.net|A', do = 1, bufsize = 1232 (4096): packetcache MISS
Sep 11 15:08:09 authdns-master pdns_server[178900]: [stub-resolver] Doing stub resolving for 'keklolwtf-web.keklolwtf.net.|A', using resolvers: 2a02:<snip>::2, <snip>.0.2
Sep 11 15:08:09 authdns-master pdns_server[178900]: [stub-resolver] Question for 'keklolwtf-web.keklolwtf.net.|A' got answered by 2a02:<snip>::2

However, if I attempt to do this on authdns1 or authdns2, I don't get the desired response;

root@authdns1:~# dig @localhost as60163.net a

; <<>> DiG 9.16.42-Debian <<>> @localhost as60163.net a
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8758
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;as60163.net.           IN  A

;; AUTHORITY SECTION:
as60163.net.        1800    IN  SOA authdns1.keklolwtf.net. hostmaster.keklolwtf.net. 2023091102 1800 600 2419200 1800

;; Query time: 0 msec
;; SERVER: ::1#53(::1)
;; WHEN: Mon Sep 11 15:09:17 CEST 2023
;; MSG SIZE  rcvd: 106

If I enable logging on authdns1, I only see the following when doing two lookups in a row;

Sep 11 15:09:17 authdns1 pdns_server[181429]: Remote ::1 wants 'as60163.net|A', do = 0, bufsize = 1232 (4096): packetcache MISS
Sep 11 15:09:21 authdns1 pdns_server[181429]: Remote ::1 wants 'as60163.net|A', do = 0, bufsize = 1232 (4096): packetcache HIT

If I look in the database for authdns1 and authdns2 (PostgreSQL backend), I can see the LUA records just fine. They are identical to the ones stored in the authdns-master database:

powerdns-master=# select name,type,content from records where domain_id=5 and type='LUA';
    name     | type |                                                                     content
-------------+------+-------------------------------------------------------------------------------------------------------------------------------------------------
 as60163.net | LUA  | A ";local r=resolve('keklolwtf-web.keklolwtf.net', pdns.A) local t={} for _,v in ipairs(r) do table.insert(t, v:toString()) end return t"
 as60163.net | LUA  | AAAA ";local r=resolve('keklolwtf-web.keklolwtf.net', pdns.AAAA) local t={} for _,v in ipairs(r) do table.insert(t, v:toString()) end return t"
(2 rows)


powerdns-ns1=# select name,type,content from records where domain_id=7 and type='LUA';
    name     | type |                                                                     content
-------------+------+-------------------------------------------------------------------------------------------------------------------------------------------------
 as60163.net | LUA  | A ";local r=resolve('keklolwtf-web.keklolwtf.net', pdns.A) local t={} for _,v in ipairs(r) do table.insert(t, v:toString()) end return t"
 as60163.net | LUA  | AAAA ";local r=resolve('keklolwtf-web.keklolwtf.net', pdns.AAAA) local t={} for _,v in ipairs(r) do table.insert(t, v:toString()) end return t"
(2 rows)

I initially thought it could be related to not having set the resolver configuration parameter. However, it seems like it picks the system resolvers if it's unset (which is also evident from the logs on authdns-master above, which was done without having resolver set). I can also see during the startup on authdns1 and authdns2 that resolver is working fine;

Sep 11 15:13:30 authdns1 pdns_server[181355]: [stub-resolver] Doing stub resolving for 'auth-4.8.2.security-status.secpoll.powerdns.com.|TXT', using resolvers: 2a02:<snip>::2, <snip>.0.2
Sep 11 15:13:30 authdns1 pdns_server[181355]: [stub-resolver] Question for 'auth-4.8.2.security-status.secpoll.powerdns.com.|TXT' got answered by 2a02:<snip>::2

Anyone have any ideas why this might not be working?

I also notice that the logs has do = 1 on authdns-master versus the do = 0 on the authdns1. Not sure what the do flag means?

Version/build-configuration is equal on all servers;

Sep 11 15:18:17 PowerDNS Authoritative Server 4.8.2 (C) 2001-2022 PowerDNS.COM BV
Sep 11 15:18:17 Using 64-bits mode. Built using gcc 10.2.1 20210110 on Sep  7 2023 07:27:39 by root@localhost.
Sep 11 15:18:17 PowerDNS comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it according to the terms of the GPL version 2.
Sep 11 15:18:17 Features: libcrypto-ecdsa libcrypto-ed25519 libcrypto-ed448 libcrypto-eddsa libgeoip libmaxminddb lua lua-records PKCS#11 protobuf sodium curl DoT scrypt
Sep 11 15:18:17 Built-in modules:
Sep 11 15:18:17 Configured with: " '--build=x86_64-linux-gnu' '--prefix=/usr' '--includedir=${prefix}/include' '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info' '--sysconfdir=/etc' '--localstatedir=/var' '--disable-option-checking' '--libdir=${prefix}/lib/x86_64-linux-gnu' '--libexecdir=${prefix}/lib/x86_64-linux-gnu' '--disable-maintainer-mode' '--disable-dependency-tracking' '--sysconfdir=/etc/powerdns' '--enable-systemd' '--with-systemd=/lib/systemd/system' '--with-dynmodules=bind ldap lmdb lua2 pipe gmysql godbc gpgsql gsqlite3 geoip remote tinydns' '--with-modules=' '--enable-ixfrdist' '--enable-tools' '--with-protobuf' '--enable-unit-tests' '--enable-lua-records' '--enable-experimental-pkcs11' '--enable-dns-over-tls' '--disable-silent-rules' 'build_alias=x86_64-linux-gnu' 'CFLAGS=-g -O2 -ffile-prefix-map=/pdns/pdns-4.8.2=. -fstack-protector-strong -Wformat -Werror=format-security' 'LDFLAGS=-Wl,-z,relro -Wl,-z,now' 'CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2' 'CXXFLAGS=-g -O2 -ffile-prefix-map=/pdns/pdns-4.8.2=. -fstack-protector-strong -Wformat -Werror=format-security'"

[Habbie]

Please read #13200 and update your post, thanks!

[joachimtingvold]

Done.

[Habbie]

I also notice that the logs has do = 1 on authdns-master versus the do = 0 on the authdns1. Not sure what the do flag means?

DO means 'DNSSEC OK'. dig sets it when you pass +dnssec, for example. It should not make a difference here.

I do not have another explanation for the failure, however. Are you sure the configuration is identical?

[joachimtingvold]

Things that I consider to be of relevance here is identical, but my assumption might be wrong...

The configuration on each node is split in three configuration files;

• /etc/powerdns/pdns.conf: Identical on all nodes (just double checked with diff). Has include-dir=/etc/powerdns/pdns.d configured, that includes the two configuration files below.
• /etc/powerdns/pdns.d/authdns-{master,ns1,ns2}.conf: Node-specific configuration
• /etc/powerdns/pdns.d/postgresql.conf: Database backend configuration

There is no diff for the main pdns.conf between nodes. The only diff for postgresql.conf are the database names, user and password.

As for the node-specific configuration, please see below diff. I've also included sanitized versions of complete config files (pdns.conf and node-specific config file for authdns-master and authdns1).

diff between config files:

root@server:~# diff -u authdns-master/pdns.conf authdns-ns1/pdns.conf
root@server:~#


root@server:~# diff -u authdns-ns1.conf authdns-master.conf
--- authdns-ns1.conf  2023-09-12 11:22:57.918214615 +0200
+++ authdns-master.conf 2023-09-12 11:23:36.657337981 +0200
@@ -1,20 +1,41 @@
 # overrides our reported hostname for carbon stats
-carbon-ourname=authdns1
+carbon-ourname=authdns-master

 # local IP addresses to which we bind
-local-address=127.0.0.1,::1,185.54.28.5,2a02:4260::5
+local-address=127.0.0.1,::1,<snip>

 # source IP address for sending queries
-query-local-address=185.54.28.5,2a02:4260::5
+query-local-address=127.0.0.1,<snip>

 # act as a master/primary
-primary=no
+primary=yes

 # act as a slave/secondary
-secondary=yes
+secondary=no

 # returned when queried for 'server.id' TXT or NSID
-server-id=authdns1.keklolwtf.net
+server-id=<snip>
+
+# enable/disable the REST API
+api=yes
+
+# static pre-shared authentication key for access to the REST API
+api-key=<snip>
+
+# start a webserver for monitoring
+webserver=yes
+
+# IP address of webserver to listen on
+webserver-address=<snip>
+
+# webserver access is only allowed from these subnets
+webserver-allow-from=<snip>
+
+# port of webserver to listen on
+webserver-port=<snip>
+
+# when notifying a domain, also notify these nameservers
+also-notify=2a02:4260::5
+also-notify+=2a02:4261::5
+also-notify+=2001:41d0:701:1100::1196

-# enable autoprimary-support
-autosecondary=yes

pdns.conf:

# allow zonetransfers only from these sources
allow-axfr-ips=127.0.0.1,::1
allow-axfr-ips+=185.54.28.5,2a02:4260::5
allow-axfr-ips+=185.54.29.5,2a02:4261::5
allow-axfr-ips+=135.125.132.198,2001:41d0:701:1100::1196

# set to empty string; use ALLOW-DNSUPDATE-FROM domain metadata to control this
allow-dnsupdate-from=

# only send AXFR NOTIFY to these IP addresses or netmasks
only-notify=127.0.0.1,::1
only-notify+=185.54.28.5,2a02:4260::5
only-notify+=185.54.29.5,2a02:4261::5
only-notify+=135.125.132.198,2001:41d0:701:1100::1196

# location of configuration directory (pdns.conf)
config-dir=/etc/powerdns

# where the controlsocket will live
socket-dir=/var/run

# include *.conf files from this directory
include-dir=/etc/powerdns/pdns.d

# operate as a daemon
daemon=yes

# seconds a result is valid
default-ttl=1800

# don't disable zonetransfers
disable-axfr=no

# allow DNS updates
dnsupdate=yes

# allow LUA records
enable-lua-records=yes

# run within a guardian process
guardian=yes

# if set, change group/user id for more security
setgid=pdns
setuid=pdns

# powerDNS version in packets - full, anonymous, powerdns or custom
version-string=anonymous

# don't allow autoprimary to create zones without TSIG signed NOTIFY
allow-unsigned-autoprimary=no

# don't disable logging to syslog
disable-syslog=no

# default loglevel=4, increase to 7 for full debug
#loglevel=7
#log-dns-queries=yes
#log-dns-details=yes

authdns-master.conf:

# override our reported hostname for carbon stats
carbon-ourname=authdns-master

# local IP addresses to which we bind
local-address=127.0.0.1,::1,<snip>

# source IP address for sending queries
query-local-address=127.0.0.1,<snip>

# act as a master/primary
primary=yes

# act as a slave/secondary
secondary=no

# returned when queried for 'server.id' TXT or NSID
server-id=<snip>

# enable the REST API
api=yes

# static pre-shared authentication key for access to the REST API
api-key=<snip>

# start a webserver for monitoring
webserver=yes

# IP address of webserver to listen on
webserver-address=<snip>

# webserver access is only allowed from these subnets
webserver-allow-from=<snip>

# port of webserver to listen on
webserver-port=<snip>

# when notifying a domain, also notify these nameservers
also-notify=2a02:4260::5
also-notify+=2a02:4261::5
also-notify+=2001:41d0:701:1100::1196

authdns-ns1.conf:

# override our reported hostname for carbon stats
carbon-ourname=authdns1

# local IP addresses to which we bind
local-address=127.0.0.1,::1,185.54.28.5,2a02:4260::5

# source IP address for sending queries
query-local-address=185.54.28.5,2a02:4260::5

# act as a master/primary
primary=no

# act as a slave/secondary
secondary=yes

# returned when queried for 'server.id' TXT or NSID
server-id=authdns1.keklolwtf.net

# enable autoprimary-support
autosecondary=yes

[joachimtingvold]

In essence, the only config differences between authdns-master and authdns1 (if we ignore web-server/API specific configuration) is the primary=yes/no, secondary=yes/no and autosecondary=yes, as far as I can tell.