IPA dynamic DNS updates only the AAAA record. Where are my A records?

Question

I'm setting up a FreeIPA domain. In my lab are three virtual machines: the domain controller ipadc1, and two clients puppet and wordpress (creative, yes, I know). All three VMs are running freshly installed CentOS 6.4 (FreeIPA 3.0.0).

I've installed the IPA server, creating a domain which we'll call example.us here, with DNS service and automatic DNS updates enabled.

I've successfully joined the two VMs to the domain. But the dynamic DNS updates are only putting AAAA records into the DNS. No A records are ever inserted.

DNS RRs

My DNS zone settings for dyanmic updates and BIND update policy appear to be correct as well.

DNS zone settings

Both client VMs actually have IPv4 addresses; puppet has a static IPv4 address and wordpress gets its IPv4 address from DHCP. This doesn't seem to make a difference.

# ip a s dev eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 52:54:00:3c:d5:f5 brd ff:ff:ff:ff:ff:ff
    inet 172.25.50.227/24 brd 172.25.50.255 scope global eth0
    inet6 2001:db8:16:bf:5054:ff:fe3c:d5f5/64 scope global dynamic 
       valid_lft 86180sec preferred_lft 14180sec
    inet6 fe80::5054:ff:fe3c:d5f5/64 scope link 
       valid_lft forever preferred_lft forever

The trouble actually seems to be with sssd, which I learned is actually responsible for pushing the dynamic DNS updates. I cranked up debugging with debug_level = 9 and found this in the logs. It seems to indicate that sssd isn't even bothering with attempting to send an A record, though it doesn't really give me any indication why.

(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [ipa_dyndns_update_send] (0x4000): Performing update
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [ok_for_dns] (0x0200): Multicast IPv4 address 172.25.50.227
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [ok_for_dns] (0x0200): Link local IPv6 address fe80::5054:ff:fe3c:d5f5
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [ipa_dyndns_gss_tsig_update_step] (0x1000): Checking if the update is needed
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [resolv_get_family_order] (0x1000): Lookup order: ipv6_first
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [resolv_is_address] (0x4000): [wordpress.example.us] does not look like an IP address
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [resolv_gethostbyname_step] (0x2000): Querying DNS
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [resolv_gethostbyname_dns_query] (0x0100): Trying to resolve AAAA record of 'wordpress.example.us' in DNS
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [schedule_request_timeout] (0x2000): Scheduling a timeout of 5 seconds
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [schedule_timeout_watcher] (0x2000): Scheduling DNS timeout watcher
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [unschedule_timeout_watcher] (0x4000): Unscheduling DNS timeout watcher
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [request_watch_destructor] (0x0400): Deleting request watch
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [resolv_gethostbyname_step] (0x2000): Querying DNS
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [resolv_gethostbyname_dns_query] (0x0100): Trying to resolve A record of 'wordpress.example.us' in DNS
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [schedule_request_timeout] (0x2000): Scheduling a timeout of 5 seconds
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [schedule_timeout_watcher] (0x2000): Scheduling DNS timeout watcher
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [unschedule_timeout_watcher] (0x4000): Unscheduling DNS timeout watcher
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [request_watch_destructor] (0x0400): Deleting request watch
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [resolv_gethostbyname_next] (0x0200): No more address families to retry
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [resolv_gethostbyname_next] (0x0100): No more hosts databases to retry
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [resolv_is_address] (0x4000): [wordpress.example.us] does not look like an IP address
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [resolv_gethostbyname_step] (0x2000): Querying DNS
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [resolv_gethostbyname_dns_query] (0x0100): Trying to resolve A record of 'wordpress.example.us' in DNS
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [schedule_request_timeout] (0x2000): Scheduling a timeout of 5 seconds
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [schedule_timeout_watcher] (0x2000): Scheduling DNS timeout watcher
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [unschedule_timeout_watcher] (0x4000): Unscheduling DNS timeout watcher
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [request_watch_destructor] (0x0400): Deleting request watch
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [resolv_gethostbyname_next] (0x0200): No more address families to retry
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [resolv_gethostbyname_next] (0x0100): No more hosts databases to retry
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [ipa_dyndns_gss_tsig_update_check] (0x1000): Address on localhost only: 2001:db8:16:bf:5054:ff:fe3c:d5f5
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [ipa_dyndns_gss_tsig_update_check] (0x0400): Detected IP addresses change, will perform an update
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [create_nsupdate_message] (0x0200): Creating update message for realm [EXAMPLE.US] and zone [example.us].
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [create_nsupdate_message] (0x0400):  -- Begin nsupdate message --
realm EXAMPLE.US
zone example.us.
update delete wordpress.example.us. in A
send
update delete wordpress.example.us. in AAAA
send
update add wordpress.example.us. 86400 in AAAA 2001:db8:16:bf:5054:ff:fe3c:d5f5
send
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [create_nsupdate_message] (0x0400):  -- End nsupdate message --
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [child_handler_setup] (0x2000): Setting up signal handler up for pid [2144]
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [child_handler_setup] (0x2000): Signal handler set up for pid [2144]
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [write_pipe_handler] (0x0400): All data has been sent!
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [ipa_dyndns_stdin_done] (0x4000): Sending nsupdate data complete
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [child_sig_handler] (0x1000): Waiting for child [2144].
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [child_sig_handler] (0x0100): child [2144] finished successfully.
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [sss_child_handler] (0x2000): waitpid failed [10]: No child processes
(Mon Jul 22 21:50:01 2013) [sssd[be[example.us]]] [ipa_dyndns_update_done] (0x0020): DNS update finished

My sssd.conf is:

[domain/example.us]

cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = example.us
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname = wordpress.example.us
chpass_provider = ipa
ipa_dyndns_update = True
ipa_server = _srv_, ipadc1.example.us
ldap_tls_cacert = /etc/ipa/ca.crt
[sssd]
services = nss, pam, ssh
config_file_version = 2

domains = example.us
[nss]

[pam]

[sudo]

[autofs]

[ssh]

[pac]

The result of ipa dnszone-show example.us --all is:

  dn: idnsname=example.us,cn=dns,dc=example,dc=us
  Zone name: example.us
  Authoritative nameserver: ipadc1.example.us.
  Administrator e-mail address: hostmaster.example.us.
  SOA serial: 1374982142
  SOA refresh: 3600
  SOA retry: 900
  SOA expire: 1209600
  SOA minimum: 3600
  BIND update policy: grant EXAMPLE.US krb5-self * A; grant EXAMPLE.US krb5-self
                      * AAAA; grant EXAMPLE.US krb5-self * SSHFP;
  Active zone: TRUE
  Dynamic update: TRUE
  Allow query: any;
  Allow transfer: none;
  mxrecord: 0 mail.example.us
  nsrecord: ipadc1.example.us.
  objectclass: top, idnsrecord, idnszone
  txtrecord: v=spf1 a mx -all

While this is really a minor issue for me, since I could go live without IPv4 DNS updates (it's nice to be 100% dual stack) it's still annoying to not know what's going on here. Perhaps there are logs that I missed that would shed light on the situation?

(Oh, and yes I turned it off and on again.)

wow, everything looks exactly like I have. Probably some bug, i have lower version, you need to ask Jacob on #freeipa @freenode. Also can you try from that machine manually send the update you should have keytab for that. `nsupdate >update add wordpress.example.us 86400 A 172.25.50.227` ? — Danila Ladner, Jul 30 '13 at 05:03
@DanilaLadner Yes, if I manually run `nsupdate` then I can update the records. The problem seems to be that `sssd` is not telling `nsupdate` to update the A record. — Michael Hampton, Jul 30 '13 at 05:04

score 9 · Accepted Answer · edited Jul 07 '16 at 17:22

9

After you have added

ipa_dyndns_iface = eth0

in that pastebin i see sssd recognize your ip as multicast:

"(Tue Jul 9 10:00:01 2013) [sssd[be[example.us]]] [ok_for_dns] (0x0200): Multicast IPv4 address 172.25.50.227"

in the piece of code Jacob wrote where he would test for looback addresses, multicast addresses e.t.c. not to report to dns you will find your error:

if (IN_MULTICAST(ntohl(addr->s_addr))) {
        DEBUG(SSSDBG_FUNC_DATA, ("Multicast IPv4 address %s\n", straddr));
        return false;
    } else if (inet_netof(*addr) == IN_LOOPBACKNET) {
        DEBUG(SSSDBG_FUNC_DATA, ("Loopback IPv4 address %s\n", straddr));
        return false;
    } else if ((addr->s_addr & 0xffff0000) == 0xa9fe0000) {
        /* 169.254.0.0/16 */
        DEBUG(SSSDBG_FUNC_DATA, ("Link-local IPv4 address %s\n", straddr));
        return false;
    } else if (addr->s_addr == htonl(INADDR_BROADCAST)) {
        DEBUG(SSSDBG_FUNC_DATA, ("Broadcast IPv4 address %s\n", straddr));
        return false;
    }
} else {
    DEBUG(SSSDBG_CRIT_FAILURE, ("Unknown address family\n"));
    return false;
}

return true;

Now the question is why is it recognized as "multicast addr" i have no idea. As IN_MULTICAST in in.h you can see:

   "IN_MULTICAST(a)" - tests whether a is a multicast address. and it is in "inet.h/in.h":
   #define  IN_CLASSD(i)        (((long)(i) & 0xf0000000) == 0xe0000000)
   #define  IN_MULTICAST(i)     IN_CLASSD(i)

So how that IP Address evaluated to multicast, i would try to strace it and look. Also you could ask Jacob Hrozek, he wrote that piece of sssd code. He usually always available at #sssd on freenode, would be great if you'd share what you end up with on this. Hope it helps a little.

EDIT

Yeah, there is a bug in your version 1.9.2. You have:

  if (IN_MULTICAST(addr->s_addr))) {

It should be:

  if (IN_MULTICAST(ntohl(addr->s_addr))) {

edited Jul 07 '16 at 17:22

chicks

3,639
10
26
36

answered Jul 30 '13 at 06:19

Danila Ladner

5,241
21
30

It's a bog standard RFC 1918 address, and certainly not IPv4 multicast. So I think you're right that this is some sort of bug. Which source file was this in? – Michael Hampton Jul 30 '13 at 06:22
yeah, it is very weird. – Danila Ladner Jul 30 '13 at 06:25
dyndns.c https://git.fedorahosted.org/cgit/sssd.git/tree/src/providers/ipa/ipa_dyndns.c?id=27cf6c28bc02e7a54487d44c212a98b165a70c34 – Danila Ladner Jul 30 '13 at 06:28
what version of your sssd rpm? – Danila Ladner Jul 30 '13 at 06:31
sssd-1.9.2-82.7.el6_4.x86_64 – Michael Hampton Jul 30 '13 at 06:33
1

Wish I could upvote this a lot more than once. What a comprehensive and precise answer; applause! – MadHatter Jul 30 '13 at 06:50
Looking at the source for 1.9.2 in git, I can see that the call to `ntohl` is missing. This confirms that [it's a bug](https://fedorahosted.org/sssd/ticket/1804), which it appears was fixed in commit [27cf6c2](https://fedorahosted.org/sssd/changeset/27cf6c28bc02e7a54487d44c212a98b165a70c34/). Red Hat, unfortunately, isn't planning to fix this [until EL7](https://bugzilla.redhat.com/show_bug.cgi?id=909430)... – Michael Hampton Jul 30 '13 at 06:51
yeah, that sucks, oh well. but other than that FreeIPA in my opinion is worth playing with, and I think sssd went much farther than nscd ( a buggy piece of slow caching crap). – Danila Ladner Jul 30 '13 at 06:57
Yep, I'm excited to use it. Good thing I don't need IPv4 :) – Michael Hampton Jul 30 '13 at 07:01
This is supposedly [fixed in RHEL 6](https://rhn.redhat.com/errata/RHBA-2014-1375.html) now. – Michael Hampton Oct 14 '14 at 04:48

score 1 · Answer 2 · answered Jul 09 '13 at 09:58

From the sssd-ipa(5) manpage:

   ipa_dyndns_iface (string)
       Optional. Applicable only when ipa_dyndns_update is true. Choose the interface whose IP address should be used for dynamic DNS updates.

       Default: Use the IP address of the IPA LDAP connection

You must set ipa_dyndns_iface in /etc/sssd/sssd.conf to match the interface of the IPA server, as the default is to only use the address of the socket towards the IPA server:

ipa_dyndns_iface = eth0

That should enable dynamic updates for both IPv4 and IPv6.

Nice try, but didn't seem to help. The results of adding this are [here on pastebin](http://pastebin.com/m7QUAJm9). — Michael Hampton, Jul 09 '13 at 10:04

score 0 · Answer 3 · answered Jul 21 '13 at 08:48

0

Also try setting the lookup_family_order to non-default value such as ipv6_first as a test-case and inform us if it tries ipv4 at all.

answered Jul 21 '13 at 08:48

F.I.V

181
11

This also [had no effect](http://pastebin.com/N7tpzPBE). – Michael Hampton Jul 22 '13 at 22:07

IPA dynamic DNS updates only the AAAA record. Where are my A records?

3 Answers3

EDIT