freeipa

#5710 Fix forward zone conficts with automatic empty zones from BIND
Closed: Fixed Opened by pspacek.

Closed: Fixed
Reopen Issue

Side-effect of fixing #5087 is that we now trigger deficiency in the way how FreeIPA handles automatic empty zones. As a result, zones like 10.in-addr.arpa and other reverse zones are not forwarded to the global forwarder as expected (sometimes :-).

Fix is described in
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/AutomaticEmptyZones

Proposing for 4.3.x because #5087 was done for 4.3.0 so this 4.3+ are affected.

master:

  • 9ee6d379c496cd1648d58a6ecca72ed41638a3f1 Remove function ipapython.ipautil.host_exists()
  • 89974548891baa6dbbab401913359e398a2cbc57 Extend installers with --forward-policy option
  • bd32b48eb0180b73c3bd769b7ea2b369a095c000 Move automatic empty zone list into ipapython.dnsutil and make it reusable
  • 41464b74f43ab0a7f9ad650bdaac19308fc7ff5c Add assert_absolute_dnsname() helper to ipapython.dnsutil
  • 6752d6404af13a933105e53ea5875adfb933e293 Move function is_auto_empty_zone() into ipapython.dnsutil
  • 1df30b4646d0738c5d218acf9f65b6617a970c98 Use shared sanity check and tests ipapython.dnsutil.is_auto_empty_zone()
  • c7ee765c4de086ac92922519d7065fc6b6796f10 Add function ipapython.dnsutil.inside_auto_empty_zone()
  • 51907d5bb8fce9e5358fed50c0ec7074ef7f0c69 Auto-detect default value for --forward-policy option in installers

ipa-4-3:

  • 6dbc4ccbe42835780f7716d96ec45a9b94ed8b64 Remove function ipapython.ipautil.host_exists()
  • 54e26799540cbadafa08d1e975e46f261c521c81 Extend installers with --forward-policy option
  • 5c53cf2cd687fdd77a62dc12ed359953f547b86a Move automatic empty zone list into ipapython.dnsutil and make it reusable
  • 4a8dcc1cac0d96bf12fb608d3b12e81bbdf2503b Add assert_absolute_dnsname() helper to ipapython.dnsutil
  • ea1bf611f8b027f6a7140c532d1940eada2c6071 Move function is_auto_empty_zone() into ipapython.dnsutil
  • f2cf30d38cb28fb6f73a2df6a436658e548d2b10 Use shared sanity check and tests ipapython.dnsutil.is_auto_empty_zone()
  • fbc8a23a2ca93d998ff417fb7f9b9dcde01bddc2 Add function ipapython.dnsutil.inside_auto_empty_zone()
  • d145f8c78a5bcc5cc21be99be6225587b106c50a Auto-detect default value for --forward-policy option in installers

other patches will follow

master:

  • da71e7e9de233bc0e40a90adb2db6d0944a1356a DNS: Warn if forwarding policy conflicts with automatic empty zones
  • 0c75df4bf3784eae08f41c176bbaab44c6d510a7 Move check_zone_overlap() from ipapython.ipautil to ipapython.dnsutil
  • ec49130b94d2aa195c6b704a30fe6c3137fabdbf Use root_logger for verify_host_resolvable()
  • dc405005f537cf278fd6ddfe6b87060bd13d9a67 Move IP address resolution from ipaserver.install.installutils to ipapython.dnsutil
  • 70794c7b1d001ce331d4a64c77d23abcc02c541e Turn verify_host_resolvable() into a wrapper around ipapython.dnsutil
  • 321a2ba9185e4a21d5b2f9949cd3bec32a1fd60a Add ipaDNSVersion option to dnsconfig* commands and use new attribute
  • a4da9a23788d9f09f562c12d80353fca42f73441 DNS upgrade: separate backup logic to make it reusable
  • c978ad5b425a564b6bd3b97fb7a5e25219000e52 Add function ipapython.dnsutil.related_to_auto_empty_zone()
  • f750d42b6f2d7f792ce56b6832d2bd1ae1f333a0 DNS upgrade: change forwarding policy to = only for conflicting forward zones
  • e45a80308c947a58c0fb5266d75eedc1d9aef321 DNS upgrade: change global forwarding policy in LDAP to "only" if private IPs are used
  • 6eb00561c0f85085d86f7be936b632ba017fc4f1 DNS upgrade: change global forwarding policy in named.conf to "only" if private IPs are used

ipa-4-3:

  • b18f848bed6ace5fd63fe1c6559ebc68997ccbe2 Move check_zone_overlap() from ipapython.ipautil to ipapython.dnsutil
  • a54b8222dc2f3ec7d22e67f00b8c30b3893c0ced Use root_logger for verify_host_resolvable()
  • f170f155b9a0921b6f4ab6b24713a3c1bf0148bc Move IP address resolution from ipaserver.install.installutils to ipapython.dnsutil
  • da119a620f36bac24f43098d2f0713bb46cf4329 Turn verify_host_resolvable() into a wrapper around ipapython.dnsutil
  • d75998c55d9a961c1cbd74b3ef00a5921e9bde0a Add ipaDNSVersion option to dnsconfig* commands and use new attribute
  • 12590597320c7d4ef4506a018097dad629113fdc DNS upgrade: separate backup logic to make it reusable
  • e69254b253903aa8fd76022df7f5e5505a819ebf Add function ipapython.dnsutil.related_to_auto_empty_zone()
  • f8a39898bbd4c17d2976515c9d73f0e27a984709 DNS upgrade: change forwarding policy to = only for conflicting forward zones
  • 700246174c8c9cfbbbee5b0101acfa4227995cc7 DNS upgrade: change global forwarding policy in LDAP to "only" if private IPs are used
  • 233550ab1dab55d518cfdc104b521672babdde7f DNS upgrade: change global forwarding policy in named.conf to "only" if private IPs are used
  • 8cbecdbc8dc022005beec3a9fe19aabd91041bbf DNS: Warn if forwarding policy conflicts with automatic empty zones

master:

  • 05c8808c76c39d697008912477dc45a76409ac67 Test: fix failing host_test

ipa-4-3:

  • be65f1e2352e02086c3511f6f5a3cb4e4b5cb883 Test: fix failing host_test

Only ipa-4-3

ipa-4-3:

  • 8f6db8ffe69c0e14c97f5bdc2c0635c95f1fa225 Fix: exceptions in DNS tests should not have data attribute

master:

  • 971b4bf009f051819d757d451e213c3c82de1c97 Fix resolve_rrsets: RRSet is not hashable

ipa-4-3:

  • 262054ae571799bde40a8a8698ee6f07da5d0efb Fix resolve_rrsets: RRSet is not hashable

master:

  • ce1f9ca51bd91ed66233c1bac7eb05fac9c855c7 Remove unused is_local(), interface, and defaultnet from CheckedIPAddress
  • 5e78b54d7c532bec0ee5a4ce3f1b6d6c94d17c51 Fix internal errors in host-add and other commands caused by DNS resolution

Patches for ipa-4-3 will come later

ipa-4-3:

  • 0db277eb224b92319aede319999d1840db781c10 Remove unused is_local(), interface, and defaultnet from CheckedIPAddress
  • b8d5881ba93b00653ba42c61369f19ca27fb7a64 Fix internal errors in host-add and other commands caused by DNS resolution

Metadata Update from @pspacek:
- Issue assigned to pspacek
- Issue set to the milestone: FreeIPA 4.3.2
Metadata
None
None
None
Normal
defect
DNS
1
mbasti
https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/Design/AutomaticEmptyZones
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.