14 Říj
2019
14 Říj
'19
11:24
Hello,
Since I upgraded to 2.9 (2.9.0-1~cz.nic~buster1), DDNS update fails:
oct. 14 11:10:25 arrakeen knotd[15543]: info: [durel.org.] DDNS, processing 1 updates
oct. 14 11:10:25 arrakeen knotd[15543]: error: [durel.org.] DNSSEC, failed to fix NSEC3
chain (invalid parameter)
oct. 14 11:10:25 arrakeen knotd[15543]: 2019-10-14T11:10:25 error: [durel.org.] DNSSEC,
failed to fix NSEC3 chain (invalid parameter)
oct. 14 11:10:25 arrakeen knotd[15543]: 2019-10-14T11:10:25 error: [durel.org.] DDNS,
processing failed (invalid parameter)
oct. 14 11:10:25 arrakeen knotd[15543]: error: [durel.org.] DDNS, processing failed
(invalid parameter)
DDNS are generated with knsupdate:
knsupdate -k /etc/letsencrypt.sh/hooks/tsig.key $file
Is there a config change that can explain that ?
Thanks,
--
Bastien Durel
14 Říj
14 Říj
11:35
Hi Bastien,
It doesn't look like a config issue. Could you try to re-sign the zone `knotc
zone-sign durel.org` if it helps?
Could you show me contents of the DDNS message?
Daniel
On 10/14/19 11:24 AM, Bastien Durel wrote:
Hello,
Since I upgraded to 2.9 (2.9.0-1~cz.nic~buster1), DDNS update fails:
oct. 14 11:10:25 arrakeen knotd[15543]: info: [durel.org.] DDNS, processing 1 updates
oct. 14 11:10:25 arrakeen knotd[15543]: error: [durel.org.] DNSSEC, failed to fix NSEC3
chain (invalid parameter)
oct. 14 11:10:25 arrakeen knotd[15543]: 2019-10-14T11:10:25 error: [durel.org.] DNSSEC,
failed to fix NSEC3 chain (invalid parameter)
oct. 14 11:10:25 arrakeen knotd[15543]: 2019-10-14T11:10:25 error: [durel.org.] DDNS,
processing failed (invalid parameter)
oct. 14 11:10:25 arrakeen knotd[15543]: error: [durel.org.] DDNS, processing failed
(invalid parameter)
DDNS are generated with knsupdate:
knsupdate -k /etc/letsencrypt.sh/hooks/tsig.key $file
Is there a config change that can explain that ?
Thanks,
12:12
Le lundi 14 octobre 2019 à 11:35 +0200, Daniel Salzman a écrit :
Hi Bastien,
It doesn't look like a config issue. Could you try to re-sign the
zone `knotc zone-sign durel.org` if it helps?
Could you show me contents of the DDNS message?
Hello,
Re-signing worked, thanks !
(The messages were ACME-challenge insertions)
--
Bastien Durel
12:23
Ok, so there was some inconsistency in the zone. Interesting!
If you found anything which could explain why that happened, please let me know.
Thanks,
Daniel
On 10/14/19 12:12 PM, Bastien Durel wrote:
Le lundi 14 octobre 2019 à 11:35 +0200, Daniel Salzman
a écrit :
Hi Bastien,
It doesn't look like a config issue. Could you try to re-sign the
zone `knotc zone-sign durel.org` if it helps?
Could you show me contents of the DDNS message?
Hello,
Re-signing worked, thanks !
(The messages were ACME-challenge insertions)
15 Říj
15 Říj
18:29
Hi Bastien,
could you please detail on how did the DDNSes roughly look like? For
example, if they contained adding/removing NSEC3 records or their RRSIGs?
Thanks,
Libor
Dne 14.10.19 v 12:23 Daniel Salzman napsal(a):
Ok, so there was some inconsistency in the zone.
Interesting!
If you found anything which could explain why that happened, please let me know.
Thanks,
Daniel
On 10/14/19 12:12 PM, Bastien Durel wrote:
> Le lundi 14 octobre 2019 à 11:35 +0200, Daniel Salzman a écrit :
>> Hi Bastien,
>>
>> It doesn't look like a config issue. Could you try to re-sign the
>> zone `knotc zone-sign durel.org` if it helps?
>> Could you show me contents of the DDNS message?
>>
> Hello,
>
> Re-signing worked, thanks !
>
> (The messages were ACME-challenge insertions)
>
23:31
On 15/10/2019 18:29, libor.peltan wrote:
Hi Bastien,
could you please detail on how did the DDNSes roughly look like? For
example, if they contained adding/removing NSEC3 records or their RRSIGs?
Thanks,
Hello
The DDNSes I use are ACME-related, so I have insertions, like this :
server 10.42.42.21
zone geekwu.org.
origin geekwu.org.
ttl 600
add _acme-challenge.foo.durel.org. 600 in TXT "bar"
send
quit
or deletions, that are the same format (script generated)
All message are then sent by knsupdate -k /path/to/key $file
Regards,
--
Bastien Durel
16 Říj
16 Říj
19:35
Hi Bastien,
thank you for clarification.
One more question: you confirmed that re-signing of the zone with `knotc
zone-sign` solved the issue and the same DDNS was appliable afterards.
Could you please find in the output of `kjournalprint durel.org.` the
changeset created at the re-sign, and describe what is there besides all
the RRSIGs re-creation?
Libor
Dne 15.10.19 v 23:31 Bastien Durel napsal(a):
On 15/10/2019 18:29, libor.peltan wrote:
Hi Bastien,
could you please detail on how did the DDNSes roughly look like? For
example, if they contained adding/removing NSEC3 records or their
RRSIGs?
Thanks,
Hello
The DDNSes I use are ACME-related, so I have insertions, like this :
server 10.42.42.21
zone geekwu.org.
origin geekwu.org.
ttl 600
add _acme-challenge.foo.durel.org. 600 in TXT "bar"
send
quit
or deletions, that are the same format (script generated)
All message are then sent by knsupdate -k /path/to/key $file
Regards,
1894
days inactive
1896
days old
6 comments
4 participants
participants (4)
-
Bastien Durel -
Bastien Durel -
Daniel Salzman -
libor.peltan