Check zones with underscores in host names (A Records)

Discussion:

(too old to reply)

Jack Tavares

2008-02-12 10:57:13 UTC

Hello -

I use named-checkzone to check for zone validity.

However, named-checkzone will complain if there is an "_" in the domain label of an A Record.

I need to allow for underscores in A records, but I still want to check for other errors.

It seems to me that the only way to do that would be to parse the error/warning strings
to separate errors that I want to ignore (underscores) and catch errors that I care about.

Is there any other way to do this?

Example, given this zone file
$ORIGIN .
$TTL 500 ; 8 minutes 20 seconds
test.com IN SOA d62.test.net. hostmaster.d62.test.net. (
8 ; serial
10800 ; refresh (3 hours)
3600 ; retry (1 hour)
604800 ; expire (1 week)
60 ; minimum (1 minute)
)
NS d62.test.net.
$ORIGIN test.com.
under_score A 1.2.3.4
NS unknown.test.net.

calling named-checkzone thusly

named-checkzone test.com. db.test
returns
db.test:14: under_score.test.com: bad owner name (check-names)
zone test.com/IN: under_score.test.com/NS 'unknown.test.net' (out of zone) has no addresses records (A or AAAA)
zone test.com/IN: loaded serial 8
OK
with a return code of 0

Calling with
named-checkzone -kfail test.com. db.test
returns
db.test:14: under_score.test.com: bad owner name (check-names)
zone test.com/IN: loading from master file db.test failed: bad owner name (check-names)
[***@d35:Active] namedb # echo $?
1

It returns an error code of "1", but stops after the first error.

calling with

named-checkzone -kfail -ifull test.com. db.test
also stops at the first error.

using
named-checkzone -kwarn -ifull test.com . db.test
gives
db.test:14: under_score.test.com: bad owner name (check-names)
zone test.com/IN: under_score.test.com/NS 'unknown.test.net' (out of zone) has no addresses records (A or AAAA)
zone test.com/IN: loaded serial 8
OK

returns an error code of 0 (ok) but logs messages.

So, to do what I want to do,
I have to basically ignore the return code and parse the output messages to see if something has
gone wrong.

Am I missing an easier way to do this?

Thanks

--
jack

Haim [Howard] Roman

2008-02-12 11:11:55 UTC

Permalink

We also have to allow underscores (good old Microsoft!). Here is what
we have in our /etc/named.conf:

options {
...

#---------------------------------------------------------
# turn off name checking. We have too many host names with
# underscores, plus all the MS AD records we get from others.
# Anyway, while RFC 1123 forbade underscores, RFC 2181 allowed
# it *& maybe other characters. (roman 2007/12/05)

check-names master ignore;
check-names slave ignore;

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Haim (Howard) Roman
Computer Center, Jerusalem College of Technology
***@jct.ac.il
Phone: 052-8-592-599 (6022 from within Machon Lev)

-------- Original Message --------
Subject: Check zones with underscores in host names (A Records)
From: Jack Tavares <***@F5.com>
To: bind-***@isc.org
Date: Tue Feb 12 2008 12:57:13 GMT+0200 (IST)

Post by Jack Tavares
Hello -
I use named-checkzone to check for zone validity.
However, named-checkzone will complain if there is an "_" in the domain label of an A Record.
I need to allow for underscores in A records, but I still want to check for other errors.
It seems to me that the only way to do that would be to parse the error/warning strings
to separate errors that I want to ignore (underscores) and catch errors that I care about.
Is there any other way to do this?
Example, given this zone file
$ORIGIN .
$TTL 500 ; 8 minutes 20 seconds
test.com IN SOA d62.test.net. hostmaster.d62.test.net. (
8 ; serial
10800 ; refresh (3 hours)
3600 ; retry (1 hour)
604800 ; expire (1 week)
60 ; minimum (1 minute)
)
NS d62.test.net.
$ORIGIN test.com.
under_score A 1.2.3.4
NS unknown.test.net.
calling named-checkzone thusly
named-checkzone test.com. db.test
returns
db.test:14: under_score.test.com: bad owner name (check-names)
zone test.com/IN: under_score.test.com/NS 'unknown.test.net' (out of zone) has no addresses records (A or AAAA)
zone test.com/IN: loaded serial 8
OK
with a return code of 0
Calling with
named-checkzone -kfail test.com. db.test
returns
db.test:14: under_score.test.com: bad owner name (check-names)
zone test.com/IN: loading from master file db.test failed: bad owner name (check-names)
1
It returns an error code of "1", but stops after the first error.
calling with
named-checkzone -kfail -ifull test.com. db.test
also stops at the first error.
using
named-checkzone -kwarn -ifull test.com . db.test
gives
db.test:14: under_score.test.com: bad owner name (check-names)
zone test.com/IN: under_score.test.com/NS 'unknown.test.net' (out of zone) has no addresses records (A or AAAA)
zone test.com/IN: loaded serial 8
OK
returns an error code of 0 (ok) but logs messages.
So, to do what I want to do,
I have to basically ignore the return code and parse the output messages to see if something has
gone wrong.
Am I missing an easier way to do this?
Thanks
--
jack

Jack Tavares

2008-02-12 11:29:03 UTC

Permalink

-----Original Message-----
Sent: Tuesday, February 12, 2008 3:12 AM
Subject: Re: Check zones with underscores in host names (A Records)
We also have to allow underscores (good old Microsoft!). Here is what
options {
...
#---------------------------------------------------------
# turn off name checking. We have too many host names with
# underscores, plus all the MS AD records we get from others.
# Anyway, while RFC 1123 forbade underscores, RFC 2181 allowed
# it *& maybe other characters. (roman 2007/12/05)
check-names master ignore;
check-names slave ignore;

That doesn't help me.
If i set the check-names master ignore and run named-checkzone on the
same
file as I showed below it get

named-checkzone test.com. db.test
db.test:14: under_score.test.com: bad owner name (check-names)
zone test.com/IN: under_score.test.com/NS 'unknown.test.net' (out of
zone) has no addresses records (A or AAAA)
zone test.com/IN: loaded serial 8
OK

With no error code. That means I still have to parse the log messages to
get the error
on the NS record.

If I call it with
named-checkzone -kfail test.com. db.test
db.test:14: under_score.test.com: bad owner name (check-names)
zone test.com/IN: loading from master file db.test failed: bad owner
name (check-names)

It still craps out on the first erorr (the underscore) and doesnt tell
me about
the NS recored

If I call it with
named-checkzone -ifull test.com. db.test
db.test:14: under_score.test.com: bad owner name (check-names)
zone test.com/IN: under_score.test.com/NS 'unknown.test.net' (out of
zone) has no addresses records (A or AAAA)
zone test.com/IN: loaded serial 8
OK

I get the error message about the NS record, but still with a return
code of 0, so I still
have to check the log messages.

So

-------- Original Message --------
Subject: Check zones with underscores in host names (A Records)
Date: Tue Feb 12 2008 12:57:13 GMT+0200 (IST)

Post by Jack Tavares
Hello -
I use named-checkzone to check for zone validity.
However, named-checkzone will complain if there is an "_"

in the domain label of an A Record.

Post by Jack Tavares
I need to allow for underscores in A records, but I still

want to check for other errors.

Post by Jack Tavares
It seems to me that the only way to do that would be to

parse the error/warning strings

Post by Jack Tavares
to separate errors that I want to ignore (underscores) and

catch errors that I care about.

Post by Jack Tavares
Is there any other way to do this?
Example, given this zone file
$ORIGIN .
$TTL 500 ; 8 minutes 20 seconds
test.com IN SOA d62.test.net.

hostmaster.d62.test.net. (

Post by Jack Tavares
8 ; serial
10800 ; refresh (3 hours)
3600 ; retry (1 hour)
604800 ; expire (1 week)
60 ; minimum (1 minute)
)
NS d62.test.net.
$ORIGIN test.com.
under_score A 1.2.3.4
NS unknown.test.net.
calling named-checkzone thusly
named-checkzone test.com. db.test
returns
db.test:14: under_score.test.com: bad owner name (check-names)
zone test.com/IN: under_score.test.com/NS

'unknown.test.net' (out of zone) has no addresses records (A or AAAA)

Post by Jack Tavares
zone test.com/IN: loaded serial 8
OK
with a return code of 0
Calling with
named-checkzone -kfail test.com. db.test
returns
db.test:14: under_score.test.com: bad owner name (check-names)

bad owner name (check-names)

Post by Jack Tavares
1
It returns an error code of "1", but stops after the first error.
calling with
named-checkzone -kfail -ifull test.com. db.test
also stops at the first error.
using
named-checkzone -kwarn -ifull test.com . db.test
gives
db.test:14: under_score.test.com: bad owner name (check-names)
zone test.com/IN: under_score.test.com/NS

'unknown.test.net' (out of zone) has no addresses records (A or AAAA)

Post by Jack Tavares
zone test.com/IN: loaded serial 8
OK
returns an error code of 0 (ok) but logs messages.
So, to do what I want to do,
I have to basically ignore the return code and parse the

output messages to see if something has

Post by Jack Tavares
gone wrong.
Am I missing an easier way to do this?
Thanks
--
jack

Gregory Hicks

2008-02-12 13:55:17 UTC

Permalink

Date: Tue, 12 Feb 2008 13:11:55 +0200
Subject: Re: Check zones with underscores in host names (A Records)
X-JCT-Whitelist: NO
We also have to allow underscores (good old Microsoft!). Here is what

Underscore in DOMAIN names seem to be OK.

If you were to do this:

_sub_domain_1.example.com. ....
instead of this:
_sub_domain_1 ....

It should be OK. Of course, you have to set up the rest of the
delegation...

options {
...
#---------------------------------------------------------
# turn off name checking. We have too many host names with
# underscores, plus all the MS AD records we get from others.
# Anyway, while RFC 1123 forbade underscores, RFC 2181 allowed
# it *& maybe other characters. (roman 2007/12/05)
check-names master ignore;
check-names slave ignore;
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Haim (Howard) Roman
Computer Center, Jerusalem College of Technology
Phone: 052-8-592-599 (6022 from within Machon Lev)
-------- Original Message --------
Subject: Check zones with underscores in host names (A Records)
Date: Tue Feb 12 2008 12:57:13 GMT+0200 (IST)

Post by Jack Tavares
Hello -
I use named-checkzone to check for zone validity.
However, named-checkzone will complain if there is an "_" in the

domain label of an A Record.

Post by Jack Tavares
I need to allow for underscores in A records, but I still want to

check for other errors.

Post by Jack Tavares
It seems to me that the only way to do that would be to parse the

error/warning strings

Post by Jack Tavares
to separate errors that I want to ignore (underscores) and catch

errors that I care about.

Post by Jack Tavares
Is there any other way to do this?
Example, given this zone file
$ORIGIN .
$TTL 500 ; 8 minutes 20 seconds
test.com IN SOA d62.test.net.

hostmaster.d62.test.net. (

zone) has no addresses records (A or AAAA)

name (check-names)

zone) has no addresses records (A or AAAA)

Post by Jack Tavares
zone test.com/IN: loaded serial 8
OK
returns an error code of 0 (ok) but logs messages.
So, to do what I want to do,
I have to basically ignore the return code and parse the output

messages to see if something has

Post by Jack Tavares
gone wrong.
Am I missing an easier way to do this?
Thanks
--
jack

---------------------------------------------------------------------
Gregory Hicks | Principal Systems Engineer
Cadence Design Systems | Direct: 408.576.3609
555 River Oaks Pkwy M/S 9B1
San Jose, CA 95134

I am perfectly capable of learning from my mistakes. I will surely
learn a great deal today.

"A democracy is a sheep and two wolves deciding on what to have for
lunch. Freedom is a well armed sheep contesting the results of the
decision."

"The best we can hope for concerning the people at large is that they
be properly armed." --Alexander Hamilton

Gregory Hicks

2008-02-12 13:53:01 UTC

Permalink

Post by Haim [Howard] Roman
Subject: Check zones with underscores in host names (A Records)
Date: Tue, 12 Feb 2008 02:57:13 -0800
Hello -
I use named-checkzone to check for zone validity.
However, named-checkzone will complain if there is an "_" in the

domain label of an A Record.

Post by Haim [Howard] Roman
I need to allow for underscores in A records, but I still want to

check for other errors.

Post by Haim [Howard] Roman
It seems to me that the only way to do that would be to parse the

error/warning strings

Post by Haim [Howard] Roman
to separate errors that I want to ignore (underscores) and catch

errors that I care about.

Post by Haim [Howard] Roman
Is there any other way to do this?

Raplace all "_" with "-", run named-checkzone, then replace all "-"
with "_"...? Underscore is NOT a legal char in host names according to
all RFCs that I have read... (I may have missed one though.)

Regards,
GRegory Hicks

Post by Haim [Howard] Roman
Example, given this zone file
$ORIGIN .
$TTL 500 ; 8 minutes 20 seconds
test.com IN SOA d62.test.net. hostmaster.d62.test.net.

(

Post by Haim [Howard] Roman
8 ; serial
10800 ; refresh (3 hours)
3600 ; retry (1 hour)
604800 ; expire (1 week)
60 ; minimum (1 minute)
)
NS d62.test.net.
$ORIGIN test.com.
under_score A 1.2.3.4
NS unknown.test.net.
calling named-checkzone thusly
named-checkzone test.com. db.test
returns
db.test:14: under_score.test.com: bad owner name (check-names)
zone test.com/IN: under_score.test.com/NS 'unknown.test.net' (out of

zone) has no addresses records (A or AAAA)

Post by Haim [Howard] Roman
zone test.com/IN: loaded serial 8
OK
with a return code of 0
Calling with
named-checkzone -kfail test.com. db.test
returns
db.test:14: under_score.test.com: bad owner name (check-names)
zone test.com/IN: loading from master file db.test failed: bad owner

name (check-names)

Post by Haim [Howard] Roman
1
It returns an error code of "1", but stops after the first error.
calling with
named-checkzone -kfail -ifull test.com. db.test
also stops at the first error.
using
named-checkzone -kwarn -ifull test.com . db.test
gives
db.test:14: under_score.test.com: bad owner name (check-names)
zone test.com/IN: under_score.test.com/NS 'unknown.test.net' (out of

zone) has no addresses records (A or AAAA)

Post by Haim [Howard] Roman
zone test.com/IN: loaded serial 8
OK
returns an error code of 0 (ok) but logs messages.
So, to do what I want to do,
I have to basically ignore the return code and parse the output

messages to see if something has

Post by Haim [Howard] Roman
gone wrong.
Am I missing an easier way to do this?
Thanks
--
jack

kirk

2008-02-12 14:18:34 UTC

Permalink

Jack,

What about this?
named-checkzone -k ignore -i none test.com test.db

Mark Andrews

2008-02-12 22:10:49 UTC

Permalink

Post by Gregory Hicks

Date: Tue, 12 Feb 2008 13:11:55 +0200
Subject: Re: Check zones with underscores in host names (A Records)
X-JCT-Whitelist: NO
We also have to allow underscores (good old Microsoft!). Here is what

Underscore in DOMAIN names seem to be OK.

Underscores are illegal in hostnames. You store hostnames
in the DNS. You also store other types of names in the DNS.
For some of those other types of names underscores are legal.

!#@!#%$!@#.example.com is a legal domain name.
Does anyone here think that !#@!#%$!@#.example.com is a legal
hostname?

Mark

Post by Gregory Hicks
_sub_domain_1.example.com. ....
_sub_domain_1 ....
It should be OK. Of course, you have to set up the rest of the
delegation...

Post by Jack Tavares
Hello -
I use named-checkzone to check for zone validity.
However, named-checkzone will complain if there is an "_" in the

domain label of an A Record.

Post by Jack Tavares
I need to allow for underscores in A records, but I still want to

check for other errors.

Post by Jack Tavares
It seems to me that the only way to do that would be to parse the

error/warning strings

Post by Jack Tavares
to separate errors that I want to ignore (underscores) and catch

errors that I care about.

Post by Jack Tavares
Is there any other way to do this?
Example, given this zone file
$ORIGIN .
$TTL 500 ; 8 minutes 20 seconds
test.com IN SOA d62.test.net.

hostmaster.d62.test.net. (

zone) has no addresses records (A or AAAA)

name (check-names)

Post by Jack Tavares
1
It returns an error code of "1", but stops after the first error.
calling with
named-checkzone -kfail -ifull test.com. db.test
also stops at the first error.
using

named-checkzone -kwarn -ifull test.com . db.test

Post by Jack Tavares
gives
db.test:14: under_score.test.com: bad owner name (check-names)
zone test.com/IN: under_score.test.com/NS 'unknown.test.net' (out of

zone) has no addresses records (A or AAAA)

messages to see if something has

Post by Jack Tavares
gone wrong.
Am I missing an easier way to do this?
Thanks
--
jack

---------------------------------------------------------------------
Gregory Hicks | Principal Systems Engineer
Cadence Design Systems | Direct: 408.576.3609
555 River Oaks Pkwy M/S 9B1
San Jose, CA 95134
I am perfectly capable of learning from my mistakes. I will surely
learn a great deal today.
"A democracy is a sheep and two wolves deciding on what to have for
lunch. Freedom is a well armed sheep contesting the results of the
decision."
"The best we can hope for concerning the people at large is that they
be properly armed." --Alexander Hamilton

--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742 INTERNET: ***@isc.org

Kevin Darcy

2008-02-12 22:27:40 UTC

Permalink

Post by Mark Andrews

Post by Gregory Hicks

Date: Tue, 12 Feb 2008 13:11:55 +0200
Subject: Re: Check zones with underscores in host names (A Records)
X-JCT-Whitelist: NO
We also have to allow underscores (good old Microsoft!). Here is what

Underscore in DOMAIN names seem to be OK.

Underscores are illegal in hostnames. You store hostnames
in the DNS. You also store other types of names in the DNS.
For some of those other types of names underscores are legal.
hostname?

That's a bit of a straw man argument.

The real question is not "are some hostnames illegal?" (obviously some
are) or even "is the set of legal hostnames a *subset* of legal domain
names?". It's "why is BIND even trying to enforce hostname rules when
it's supposed to be a DNS implementation, and the names in question are
legal in DNS?"

I say, leave it to the OS or app layers to distinguish legal from
illegal hostnames. It's none of BINDs business and only adds extra
baggage to the code and configuration, that BIND and its admins don't
need and -- at least for the majority of us, I'd wager -- don't want.

For that matter, how does BIND even know that a given A or AAAA record
is ever going to be *used* as a hostname? Maybe someone is just using
the DNS database as a way to store arbitrary 32-bit or 128-bit chunks of
information...

- Kevin

Mark Andrews

2008-02-13 00:09:30 UTC

Permalink

Post by Kevin Darcy

Post by Mark Andrews

Post by Gregory Hicks

Date: Tue, 12 Feb 2008 13:11:55 +0200
Subject: Re: Check zones with underscores in host names (A Records)
X-JCT-Whitelist: NO
We also have to allow underscores (good old Microsoft!). Here is what

Underscore in DOMAIN names seem to be OK.

Underscores are illegal in hostnames. You store hostnames
in the DNS. You also store other types of names in the DNS.
For some of those other types of names underscores are legal.
hostname?

Because there are some resolvers that do check and named
*is* the data entry point. If named isn't the data entry
point then turn check-names off.

Post by Kevin Darcy
I say, leave it to the OS or app layers to distinguish legal from
illegal hostnames. It's none of BINDs business and only adds extra
baggage to the code and configuration, that BIND and its admins don't
need and -- at least for the majority of us, I'd wager -- don't want.

Then turn it off. We had plenty of requests to re-implement
check-names for BIND 9. Some adminstrators *like* check-names.
Some adminstrators wouldn't shift from BIND 8 until BIND 9
implemented check-names.

check-names master ignore;
check-names slave ignore;

check-names has no negative impact on those that actually want
to follow the RFC requirements for hostnames and protects them
from accidently stepping out of the legal namespace.

Post by Kevin Darcy
For that matter, how does BIND even know that a given A or AAAA record
is ever going to be *used* as a hostname? Maybe someone is just using
the DNS database as a way to store arbitrary 32-bit or 128-bit chunks of
information...

99.999% of the time a A or AAAA record will be a hostname.
For the 0.001% of cases where it isn't then turn you can
turn the checks off.

Named, by default, does not stop the records being delivered
or served. It prevents them being loaded on the master
server where there should be someone checking and be able to
adjust the policy knob if required.

Post by Kevin Darcy
- Kevin

--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742 INTERNET: ***@isc.org