Dear Maintainer,

I have installed openresolv on the systems I administer, including my
laptop, to have it setup a local caching nameserver which forwards DNS
queries to appropriate real nameservers. While it works, I found that the
current setup of openresolv configures bind to always forward queries, even
when they are for zones which are nonroutable as per rfc 1918, e.g. 127.*,
192.168.*, etc.. Now, all these zones are correctly configured by default in
debian so that the local bind servers knows to respond to them with no need
to forward them. However, openresolv overrides this by setting up bind to
ALWAYS forward queries, so I am getting lots of replies (which go into
system logs) like e.g.

named: client 127.0.0.1#38598: RFC 1918 response from Internet for 127.150.168.192.in-addr.arpa

It would be nice to be able to tell openresolv, in some configuration option
or file, to add some fields to named-zones.resolvconf so that for some zones
queries are NOT forwarded, but instead resolved by the local nameserver.
Or, perhaps add some quick howto on how to add some configuration to bind to
this effect.


Thanks, best regards
Giacomo Mulas

tags 761050 + wontfix
thanks

The upstream said:

"Not really an openresolv bug as I see it.
For example 192.168.x.x can route to 10.x.x.x even if both sets are not
publicly route-able. In-fact some Spanish ISPs do this for their
Internet TV."


regards,

Hi, sorry for the late reply

I regret to say that upstream did not understand my bug report (perhaps I
did not explain clearly).  I never claimed that requests to resolve
unroutable IPs should never be forwarded; I did claim (and maintain) that IF
the local bind is set up to be authoritative on a domain (which happens to
be an unroutable block of IPs for me, but does not have to be), then
openresolv should not override that by always forwarding queries in any
case.  So the problem is not about forwarding queries involving unroutable
addresses (even if that happens in my case) but about forwarding queries
that can have (and therefore should have) an authoritative answer from the
local bind, without going any further.

If I did not explain clearly, please let me know and I will try to explain
better. If you confirm wontfix, I will find a way to tweak my local
configuration of bind + openresolv to work around this for myself, but I do
believe the current behaviour is wrong in principle and in practice, so it
should be fixed in a more general way.

Bye
Giacomo

Hi Roy,

Please read and give us a answer.

All bug report is here:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=761050

regards,
Herbert


On Mon, 22 Jun 2015 12:25:38 +0200 (CEST) Giacomo Mulas <gmulas@oa-cagliari.inaf.it> wrote:

Sorry aboutt he late response, for some reason this ended up in my spam
filter.

OK, so you have setup bind to be authortative in some way.
Openresolv wants to setup forwarding servers.

These two facts maybe in conflict.

Now, I am no expert with bind configs, but it would really help if you
could post your non working configuration and explain how it should be
changed by openresolv to work for you.
If you can do that, I'm sure we can make more progress with this issue.

Roy