[nsd-users] Feature request: nsd-control
wouter at nlnetlabs.nl
Tue Apr 8 07:58:51 UTC 2014
-----BEGIN PGP SIGNED MESSAGE-----
Hi Mauro, Johan,
On 04/06/2014 11:42 PM, Johan Ihrén wrote:
> On 05 Apr 2014, at 00:36 , Mauro Trajber <mauro at registro.br>
>> I work at NIC.br and I'm implementing NSD support on DNSSHIM (our
>> secure hidden master). In order to add and remove zones
>> dynamically we use tools like rndc and nsd-control, that fits
>> perfect. We already have bind support and NSD support is almost
>> But on a Master-Slave architecture using NSD as slaves and
>> nsd-control to add and remove zones it's impossible to find out
>> when a zone already exists. The remote controller (nsd-control)
>> only returns success or failure. It would be nice if it returns
>> something like "zone already exists" messages, that would make it
>> easier to know if the master can retry later or not.
> I agree with the need for this.
> I remember that Stephane and I and some others discussed similar
> things a couple of weeks ago and one of the issues that came up was
> the "non-atomicity" of adding (and removing) zones from masters and
> slaves. I haven't looked at your patch, but based on the prior
> discussion I wonder whether what we would really need is
> a) a "test" operation, to check whether a zone is configured or
> not, i.e.
> nsd-control testzone foo.example
> with some reasonable semantics for return values.
The 'zonestatus example.com' command may be just what you are looking for.
> b) a "test-and-set" operation. This we sort of already have, in the
> sense that "addzone" will not add a zone if it is already there
> (but as you point out, on error we don't know what really
> happened). So to make it a more useful test-and-set the return
> values should be sorted out, which is what your patch is about.
> I'd like (a) to be able to "scan" my slaves to verify that there
> are no inconsistencies in the configured zones, and if there are,
> then I want to use (b) to fix them.
Yes some sort of consistency report is useful. I have implemented a
different patch that prints if the zone already exists. (I did not
want to modify rbtree_insert).
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
-----END PGP SIGNATURE-----
More information about the nsd-users