[Opendnssec-user] CKA_ID not always submitted

Discussion:

Thomas E.

2017-11-22 22:51:08 UTC

Hi!

I'm running OpenDNSSEC Version 2.1.3 on Debian Jessie with Mysql DB
Version 5.5.58.

I configured a DelegationSignerSubmitCommand in conf.xml like this:

<DelegationSignerSubmitCommand>/usr/local/sbin/dnskey-mailer.sh
--cka_id</DelegationSignerSubmitCommand>

dnskey-mailer.sh simply sends the key via email, which works fine.

I want the CKA_ID to be added to the output, so I put "--cka_id" at
the end of the command.

The strange thing is that the CKA_ID sometimes is being submitted and
sometimes it's not:

test1.de. 3600 IN DNSKEY 257 3 8
AwEAAaGNiYx+Icw3OLfk1vK9Vh95uwBTyEK7FwLzRPf1QymQVtfeNOp51i9vJh7L9vYVAkxLc9BaoDnkihY6GwP3LwJjWzbmUr/3jJIrIrR+A+FVoKM1jVfKCQG3m7nbFHrPvE+r9+6v2wPzivLIgxnZ31bqHaevkkf773Uk3aCOVepwGQ3ifw58akI6YhjaYe/rPh3ufGLrZL0273yDOgsIJzLaJx2JtJWafrmWIF3XuQwI1MlqntIAG9eeGOp0XRA/CfRdgBvYLBguMk9APL998EYiMWQVX6gKh9cBG/6dbaRH8OAtgPT8MmydvMkEEBtH6769/m9K8k+1qj5pg3xXz40=
; {cka_id = d99db023164de14a1b9a3a555802ec74}

test2.de. 3600 IN DNSKEY 257 3 8
AwEAAbZWzlDYGtXCPHKb+vSfDxrAZoOjXudVse7ja9NsdxoJjpN8QgkE+HOSbqG7XnVclXQdWp+k7htsuAnKk/4ixeyViWEe/MDQA93fdx9Gh9l2aO+IZIS+4HwXdVWQyFTcAjkRkZ2gqTuq7rtgO58yTLd3EFJMnG90I5bVDLb11f9BBD3U2bJ8KAepwza3vnEFe//mpxM5QIT2eV/rFRCAceglbOvVUaQYWJnfU87qY7Tnfo1mi6c65uaRqOikz0evObumuYddutHEq3n/cPSjUeY3jzsi7IQj+FBWFJEdbESc2yqgdYyut6ruNUk0RkpwtzTDy/KL+IzFYTV3gz4qwDk=

Has anyone experienced the same issue?

Thanks a lot,
Thomas

Yuri Schaeffer

2017-11-23 20:51:19 UTC

Permalink

Hi Thomas,

Post by Thomas E.
I want the CKA_ID to be added to the output, so I put "--cka_id" at
the end of the command.
The strange thing is that the CKA_ID sometimes is being submitted and

Thanks for reporting! My colleague Hoda hunt it down today and it
appears to be a bug you stumbled up on. A fix has been made and will be
included in a future release. At this point I can't give you any
timeline on a release date yet.

Though, if you compile OpenDNSSEC yourself, you can find her patch here:
https://github.com/opendnssec/opendnssec/pull/719/commits/cac167a2814a221d22a32a4334c3b7bca8da6197

//Yuri

Thomas E.

2017-11-23 20:54:26 UTC

Permalink

Hi Yuri,

great, thank you for that!!

Thomas

Post by Yuri Schaeffer
Hi Thomas,

Post by Thomas E.
I want the CKA_ID to be added to the output, so I put "--cka_id" at
the end of the command.
The strange thing is that the CKA_ID sometimes is being submitted and

Thanks for reporting! My colleague Hoda hunt it down today and it
appears to be a bug you stumbled up on. A fix has been made and will be
included in a future release. At this point I can't give you any
timeline on a release date yet.
https://github.com/opendnssec/opendnssec/pull/719/commits/cac167a2814a221d22a32a4334c3b7bca8da6197
//Yuri
_______________________________________________
Opendnssec-user mailing list
https://lists.opendnssec.org/mailman/listinfo/opendnssec-user

Thomas E.

2017-11-26 15:23:07 UTC

Permalink

Hi Yuri,

just wanted to give you a short feedback. The patch works as expected,
the cka_id is now being submitted every time.

Thank you!
Thomas

Post by Yuri Schaeffer
Hi Thomas,

Post by Thomas E.
I want the CKA_ID to be added to the output, so I put "--cka_id" at
the end of the command.
The strange thing is that the CKA_ID sometimes is being submitted and

Thanks for reporting! My colleague Hoda hunt it down today and it
appears to be a bug you stumbled up on. A fix has been made and will be
included in a future release. At this point I can't give you any
timeline on a release date yet.
https://github.com/opendnssec/opendnssec/pull/719/commits/cac167a2814a221d22a32a4334c3b7bca8da6197
//Yuri
_______________________________________________
Opendnssec-user mailing list
https://lists.opendnssec.org/mailman/listinfo/opendnssec-user

Thomas E.

2017-12-07 12:24:15 UTC

Permalink

Hi!

For some reason the enforcerd suddenly died with a segmentation fault.
The enforcer has been running for while without issues and suddenly it
crashed.

The only difference to the runs it did before is that it ended up with
the result that a DS record needed to be updated:

"[enforce_task] please submit DS with keytag 22922 for zone test.de"

These are the logs from the last run:

Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone: processing key
f241eca9cc2dd5fa798ddf5a2b0cc3a7 1
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone: processing key
726d615a60d61a54e223ace3da7cd07c 1
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone: processing key
712850eb5fd42777c9a57dc4e94702d7 1
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone: processing key
74e8c23de67e15851a0d8b8b987a20db 1
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone: processing key
92ab7c79b96e994bc735c062814acd08 1
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone: processing key
f5e958d5c501556480c0d0db331570bb 1
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone: processing key
0a18212e851969c77182447fcdce863c 1
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone: processing key
a2b814b5ed20b9ab08f2b2a8f6b25aad 1
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone: May ZSK
a2b814b5ed20b9ab08f2b2a8f6b25aad DNSKEY in state omnipresent transition
to unretentive?
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone Policy says we
can (1/3)
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone: May ZSK
a2b814b5ed20b9ab08f2b2a8f6b25aad RRSIG in state unretentive transition
to hidden?
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone Policy says we
can (1/3)
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone: processing key
40217e390dabe3ffd572d23d05830d79 4
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone: processing key
0426252c04a4cc3419b18e41a027b530 1
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone: May ZSK
0426252c04a4cc3419b18e41a027b530 RRSIG in state rumoured transition to
omnipresent?
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone Policy says we
can (1/3)
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone DNSSEC says we
can (2/3)
Dec 6 19:22:52 ods ods-enforcerd: [enforce_task] please retract DS with
keytag 47476 for zone test.de
Dec 6 19:22:52 ods ods-enforcerd: [enforce_task] please submit DS with
keytag 22922 for zone test.de
Dec 6 19:22:52 ods ods-enforcerd: Segmentation fault
Dec 6 19:22:52 ods ods-enforcerd: :
Dec 6 19:22:52 ods ods-enforcerd: inlined method
Dec 6 19:22:52 ods ods-enforcerd: inlined method
Dec 6 19:22:52 ods ods-enforcerd: keystate/keystate_ds.c:150 in
exec_dnskey_by_id()
Dec 6 19:22:52 ods ods-enforcerd: keystate/keystate_ds.c:231 in
retract_dnskey_by_id()
Dec 6 19:22:52 ods ods-enforcerd: keystate/keystate_ds.c:402 in
change_keys_from_to()
Dec 6 19:22:52 ods ods-enforcerd:
keystate/keystate_ds_retract_task.c:44 in keystate_ds_retract_task_perform()
Dec 6 19:22:52 ods ods-enforcerd: scheduler/task.c:120 in task_perform()
Dec 6 19:22:52 ods ods-enforcerd: scheduler/worker.c:71 in worker_start()
Dec 6 19:22:52 ods ods-enforcerd:
/root/opendnssec-2.1.3/common/janitor.c:306 in runthread()
Dec 6 19:22:52 ods ods-enforcerd: inlined method
Dec 6 19:22:52 ods ods-enforcerd: inlined method
Dec 6 19:22:52 ods ods-enforcerd: inlined method
Dec 6 19:22:52 ods ods-enforcerd: Threaddump
Dec 6 19:22:52 ods ods-enforcerd: :
Dec 6 19:22:52 ods ods-enforcerd: inlined method
Dec 6 19:22:52 ods ods-enforcerd: inlined method
Dec 6 19:22:52 ods ods-enforcerd: inlined method
Dec 6 19:22:52 ods ods-enforcerd: scheduler/task.c:117 in task_perform()
Dec 6 19:22:52 ods ods-enforcerd: scheduler/worker.c:71 in worker_start()
Dec 6 19:22:52 ods ods-enforcerd:
/root/opendnssec-2.1.3/common/janitor.c:306 in runthread()
Dec 6 19:22:52 ods ods-enforcerd: inlined method
Dec 6 19:22:52 ods ods-enforcerd: inlined method
Dec 6 19:22:52 ods ods-enforcerd: inlined method
Dec 6 19:22:52 ods ods-enforcerd: Threaddump
Dec 6 19:22:52 ods ods-enforcerd: :
Dec 6 19:22:52 ods ods-enforcerd: inlined method
Dec 6 19:22:52 ods ods-enforcerd: inlined method
Dec 6 19:22:52 ods ods-enforcerd: inlined method
Dec 6 19:22:52 ods ods-enforcerd: scheduler/task.c:117 in task_perform()
Dec 6 19:22:52 ods ods-enforcerd: scheduler/worker.c:71 in worker_start()
Dec 6 19:22:52 ods ods-enforcerd:
/root/opendnssec-2.1.3/common/janitor.c:306 in runthread()
Dec 6 19:22:52 ods ods-enforcerd: inlined method
Dec 6 19:22:52 ods ods-enforcerd: inlined method
Dec 6 19:22:52 ods ods-enforcerd: inlined method
Dec 6 19:22:52 ods ods-enforcerd: Threaddump
Dec 6 19:22:52 ods ods-enforcerd: :
Dec 6 19:22:52 ods ods-enforcerd: inlined method
Dec 6 19:22:52 ods ods-enforcerd:
/root/opendnssec-2.1.3/common/locks.c:63 in ods_thread_wait()
Dec 6 19:22:52 ods ods-enforcerd: scheduler/schedule.c:465 in
schedule_pop_task()
Dec 6 19:22:52 ods ods-enforcerd: scheduler/worker.c:68 in worker_start()
Dec 6 19:22:52 ods ods-enforcerd:
/root/opendnssec-2.1.3/common/janitor.c:306 in runthread()
Dec 6 19:22:52 ods ods-enforcerd: inlined method
Dec 6 19:22:52 ods ods-enforcerd: inlined method
Dec 6 19:22:52 ods ods-enforcerd: inlined method
Dec 6 19:22:52 ods ods-enforcerd: Threaddump
Dec 6 19:22:52 ods ods-enforcerd: :
Dec 6 19:22:52 ods ods-enforcerd: inlined method
Dec 6 19:22:52 ods ods-enforcerd:
/root/opendnssec-2.1.3/common/cmdhandler.c:388 in cmdhandler_start()
Dec 6 19:22:52 ods ods-enforcerd:
/root/opendnssec-2.1.3/common/janitor.c:306 in runthread()
Dec 6 19:22:52 ods ods-enforcerd: inlined method
Dec 6 19:22:52 ods ods-enforcerd: inlined method
Dec 6 19:22:52 ods ods-enforcerd: inlined method

Restarting is now ending up with this error:

Starting enforcer...
OpenDNSSEC key and signing policy enforcer version 2.1.3
Unable to connect to engine. connect() failed: Connection refused
("/var/run/opendnssec/enforcer.sock")

Any help would be much appreciated!

Thanks,
Thomas

Hoda Rohani

2017-12-07 12:33:06 UTC

Permalink

Hello Thomas,

Please apply this patch:
https://github.com/opendnssec/opendnssec/commit/f29b483d6e157afb9e52e751a694a90193ea2326

Actually the previous patch had a bug when passing NULL string. I guess this patch will resolve your issue.

Regards,
Hoda

Hi!
For some reason the enforcerd suddenly died with a segmentation fault. The enforcer has been running for while without
issues and suddenly it crashed.
"[enforce_task] please submit DS with keytag 22922 for zone test.de"
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone: processing key f241eca9cc2dd5fa798ddf5a2b0cc3a7 1
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone: processing key 726d615a60d61a54e223ace3da7cd07c 1
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone: processing key 712850eb5fd42777c9a57dc4e94702d7 1
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone: processing key 74e8c23de67e15851a0d8b8b987a20db 1
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone: processing key 92ab7c79b96e994bc735c062814acd08 1
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone: processing key f5e958d5c501556480c0d0db331570bb 1
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone: processing key 0a18212e851969c77182447fcdce863c 1
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone: processing key a2b814b5ed20b9ab08f2b2a8f6b25aad 1
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone: May ZSK a2b814b5ed20b9ab08f2b2a8f6b25aad DNSKEY in state
omnipresent transition to unretentive?
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone Policy says we can (1/3)
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone: May ZSK a2b814b5ed20b9ab08f2b2a8f6b25aad RRSIG in state
unretentive transition to hidden?
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone Policy says we can (1/3)
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone: processing key 40217e390dabe3ffd572d23d05830d79 4
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone: processing key 0426252c04a4cc3419b18e41a027b530 1
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone: May ZSK 0426252c04a4cc3419b18e41a027b530 RRSIG in state
rumoured transition to omnipresent?
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone Policy says we can (1/3)
Dec 6 19:22:52 ods ods-enforcerd: [enforcer] updateZone DNSSEC says we can (2/3)
Dec 6 19:22:52 ods ods-enforcerd: [enforce_task] please retract DS with keytag 47476 for zone test.de
Dec 6 19:22:52 ods ods-enforcerd: [enforce_task] please submit DS with keytag 22922 for zone test.de
Dec 6 19:22:52 ods ods-enforcerd: Segmentation fault
Dec 6 19:22:52 ods ods-enforcerd:   inlined method
Dec 6 19:22:52 ods ods-enforcerd:   inlined method
Dec 6 19:22:52 ods ods-enforcerd:   keystate/keystate_ds.c:150 in exec_dnskey_by_id()
Dec 6 19:22:52 ods ods-enforcerd:   keystate/keystate_ds.c:231 in retract_dnskey_by_id()
Dec 6 19:22:52 ods ods-enforcerd:   keystate/keystate_ds.c:402 in change_keys_from_to()
Dec 6 19:22:52 ods ods-enforcerd: keystate/keystate_ds_retract_task.c:44 in keystate_ds_retract_task_perform()
Dec 6 19:22:52 ods ods-enforcerd:   scheduler/task.c:120 in task_perform()
Dec 6 19:22:52 ods ods-enforcerd:   scheduler/worker.c:71 in worker_start()
Dec 6 19:22:52 ods ods-enforcerd: /root/opendnssec-2.1.3/common/janitor.c:306 in runthread()
Dec 6 19:22:52 ods ods-enforcerd:   inlined method
Dec 6 19:22:52 ods ods-enforcerd:   inlined method
Dec 6 19:22:52 ods ods-enforcerd:   inlined method
Dec 6 19:22:52 ods ods-enforcerd: Threaddump
Dec 6 19:22:52 ods ods-enforcerd:   inlined method
Dec 6 19:22:52 ods ods-enforcerd:   inlined method
Dec 6 19:22:52 ods ods-enforcerd:   inlined method
Dec 6 19:22:52 ods ods-enforcerd:   scheduler/task.c:117 in task_perform()
Dec 6 19:22:52 ods ods-enforcerd:   scheduler/worker.c:71 in worker_start()
Dec 6 19:22:52 ods ods-enforcerd: /root/opendnssec-2.1.3/common/janitor.c:306 in runthread()
Dec 6 19:22:52 ods ods-enforcerd:   inlined method
Dec 6 19:22:52 ods ods-enforcerd:   inlined method
Dec 6 19:22:52 ods ods-enforcerd:   inlined method
Dec 6 19:22:52 ods ods-enforcerd: Threaddump
Dec 6 19:22:52 ods ods-enforcerd:   inlined method
Dec 6 19:22:52 ods ods-enforcerd:   inlined method
Dec 6 19:22:52 ods ods-enforcerd:   inlined method
Dec 6 19:22:52 ods ods-enforcerd:   scheduler/task.c:117 in task_perform()
Dec 6 19:22:52 ods ods-enforcerd:   scheduler/worker.c:71 in worker_start()
Dec 6 19:22:52 ods ods-enforcerd: /root/opendnssec-2.1.3/common/janitor.c:306 in runthread()
Dec 6 19:22:52 ods ods-enforcerd:   inlined method
Dec 6 19:22:52 ods ods-enforcerd:   inlined method
Dec 6 19:22:52 ods ods-enforcerd:   inlined method
Dec 6 19:22:52 ods ods-enforcerd: Threaddump
Dec 6 19:22:52 ods ods-enforcerd:   inlined method
Dec 6 19:22:52 ods ods-enforcerd: /root/opendnssec-2.1.3/common/locks.c:63 in ods_thread_wait()
Dec 6 19:22:52 ods ods-enforcerd:   scheduler/schedule.c:465 in schedule_pop_task()
Dec 6 19:22:52 ods ods-enforcerd:   scheduler/worker.c:68 in worker_start()
Dec 6 19:22:52 ods ods-enforcerd: /root/opendnssec-2.1.3/common/janitor.c:306 in runthread()
Dec 6 19:22:52 ods ods-enforcerd:   inlined method
Dec 6 19:22:52 ods ods-enforcerd:   inlined method
Dec 6 19:22:52 ods ods-enforcerd:   inlined method
Dec 6 19:22:52 ods ods-enforcerd: Threaddump
Dec 6 19:22:52 ods ods-enforcerd:   inlined method
Dec 6 19:22:52 ods ods-enforcerd: /root/opendnssec-2.1.3/common/cmdhandler.c:388 in cmdhandler_start()
Dec 6 19:22:52 ods ods-enforcerd: /root/opendnssec-2.1.3/common/janitor.c:306 in runthread()
Dec 6 19:22:52 ods ods-enforcerd:   inlined method
Dec 6 19:22:52 ods ods-enforcerd:   inlined method
Dec 6 19:22:52 ods ods-enforcerd:   inlined method
Starting enforcer...
OpenDNSSEC key and signing policy enforcer version 2.1.3
Unable to connect to engine. connect() failed: Connection refused ("/var/run/opendnssec/enforcer.sock")
Any help would be much appreciated!
Thanks,
Thomas
_______________________________________________
Opendnssec-user mailing list
https://lists.opendnssec.org/mailman/listinfo/opendnssec-user

Thomas E.

2017-12-07 16:54:18 UTC

Permalink

Thanks Hoda,

then enforcer is back to life :)

Best regards,
Thomas

Post by Hoda Rohani
Hello Thomas,
https://github.com/opendnssec/opendnssec/commit/f29b483d6e157afb9e52e751a694a90193ea2326
Actually the previous patch had a bug when passing NULL string. I guess this patch will resolve your issue.
Regards,
Hoda