Skip to content
Snippets Groups Projects

Ubuntu package 2.7.3-1~ubuntu18.04.1ppa1 contains no modules (e.g. mod-queryacl)

    • Closed Issue created by Ghost User @ghost

    Hello knot-dns makers,

    we are reviewing an alternative to our actuially running nameserver software. Depending on the higher expectations to the new nameservice we would use, we give knot-dns a try. Our company use largly ubuntu as building block of the infratructure, so we depend on ubuntu packages.

    The ubunbu package version 2.7.3-1~ubuntu18.04.1ppa1 does not contain further modules like mod-queryacl for example. Is that on purpose or are there technical reasons, like build problems, for the lack of the modules?

    Greetings Frank

    Edited

    Designs

      Child items ...

      2. Activity

      • Ghost User changed title from Ubutu package 2.7.3-1~ubuntu18.04.1ppa1 contains no modules (e.g. mod-queryacl) to Ubuntu package 2.7.3-1~ubuntu18.04.1ppa1 contains no modules (e.g. mod-queryacl)

        changed title from Ubutu package 2.7.3-1~ubuntu18.04.1ppa1 contains no modules (e.g. mod-queryacl) to Ubuntu package 2.7.3-1~ubuntu18.04.1ppa1 contains no modules (e.g. mod-queryacl)

      • Daniel Salzman
        Daniel Salzman @dsalzman ·
        Owner

        Hi @fmatthiess, have you tried to configure a module? The modules are not separate libraries in our packages, as we link them statically:

        knotc> status configure
  Knot DNS 2.7.3
  ...
    Static modules: cookies dnsproxy dnstap geoip noudp onlinesign queryacl rrl stats synthrecord whoami
      • Ghost User
        Ghost User @ghost ·
        Author Contributor

        Hello,

        yes, i've tried to configure the mod-queryacl module and got an error message:

        root@f-dns1:~# knotc --force conf-import knotd.conf 
error: module, failed to open '/usr/lib/x86_64-linux-gnu/knot/query.so' (/usr/lib/x86_64-linux-gnu/knot/query.so: cannot open shared object file: No such file or directory)
error: config, file 'knotd.conf', line 17, module 'mod-query' (not exists)
error: import (not exists)

        Before knotc --force conf-import knotd.conf i stopped the knotd. My knot.conf:

        server:
  listen: "0.0.0.0@53"
  listen: "::@53"

log:
  - target: "syslog"
    any: "info"

module:
  - id: "mod-query"

mod-queryacl:
  - id: "redacted-networks"
    address: "10.0.0.0/8"
    address: "172.16.0.0/12"
    address: "192.168.0.0/16"
    interface: "ens3"

mod-cookies:
  - id: default
    secret-lifetime: 30h
    badcookie-slip: 3

template:
  - id: "default"
    storage: "/var/lib/knot/zones"
    file: "%s"
    dnssec-signing: off
    semantic-checks: on
    global-module: mod-stats
    global-module: mod-cookies/default

  - id: "zone-signed"
    storage: "/var/lib/knot/zones.signed"
    file: "%s"
    dnssec-signing: on
    semantic-checks: on

  - id: "reverse"
    storage: "/var/lib/knot/zones"
    file: "%s"
    dnssec-signing: off
    semantic-checks: on
    module: mod-queryacl/redacted-networks

  - id: "reverse-signed"
    storage: "/var/lib/knot/zones.signed"
    file: "%s"
    dnssec-signing: on
    semantic-checks: on
    module: mod-queryacl/redacted-networks

        After starting knot the output of knotc status configure is:

        root@f-dns1:~# knotc status configure
  Knot DNS 2.7.3

    Target:   linux-gnu x86_64
    Compiler: gcc
    CFLAGS:   -g -O2 -fdebug-prefix-map=/build/knot-ATf98Y/knot-2.7.3=. -fstack-protector-strong -Wformat -Werror=format-security -Wall -DNDEBUG -Wall -Werror=format-security -Werror=implicit -Wstrict-prototypes -Wdate-time -D_FORTIFY_SOURCE=2
    LIBS:     -lm  -Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now -Wl,--as-needed
    LibURCU:  -lurcu -I/usr/include/x86_64-linux-gnu
    GnuTLS:   -lgnutls -I/usr/include/p11-kit-1
    Libedit:  -ledit -lncurses -lbsd -I/usr/include/editline
    LMDB:     shared  -llmdb 
    Config:   500 MiB default mapsize

    Prefix:      /usr
    Run dir:     /run/knot
    Storage dir: /var/lib/knot
    Config dir:  /etc/knot
    Module dir:  /usr/lib/x86_64-linux-gnu/knot

    Static modules: cookies dnsproxy dnstap geoip noudp onlinesign queryacl rrl stats synthrecord whoami 
    Shared modules: 

    Knot DNS libraries:     yes
    Knot DNS daemon:        yes
    Knot DNS utilities:     yes
    Knot DNS documentation: yes

    Use recvmmsg:           yes
    Use SO_REUSEPORT:       yes
    Memory allocator:       jemalloc
    Fast zone parser:       yes
    Utilities with IDN:     yes
    Utilities with Dnstap:  yes
    MaxMind DB support:     yes
    Systemd integration:    yes
    POSIX capabilities      yes
    PKCS #11 support:       yes
    Ed25519 support:        no
    Code coverage:          no
    Sanitizer:              no
    LibFuzzer:              no
    OSS-Fuzz:               no

        Greeting Frank

      • Daniel Salzman
        Daniel Salzman @dsalzman ·
        Owner

        @fmatthiess you should remove the module section. It's needed for dynamic modules.

      • Daniel Salzman
        Daniel Salzman @dsalzman ·
        Owner

        Btw, the interface item in the queryacl configuration is intended to be an IP address. But I guess you don't want to configure this option - it's another use case.

      • Ghost User
        Ghost User @ghost ·
        Author Contributor

        Hello Daniel,

        thanks for the suggestions, i change the initial config accordingly:

        server:
  listen: "0.0.0.0@53"
  listen: "::@53"

log:
  - target: "syslog"
    any: "info"

mod-queryacl:
  #
  # query acls for reverse zones
  #
  - id: "redacted-networks"
    address: "10.0.0.0/8"
    address: "172.16.0.0/12"
    address: "192.168.0.0/16"

mod-cookies:
  - id: default
    secret-lifetime: 30h
    badcookie-slip: 3

template:
  - id: "default"
    storage: "/var/lib/knot/zones"
    file: "%s"
    dnssec-signing: off
    semantic-checks: on
#    global-module: mod-stats
    global-module: mod-cookies/default

  - id: "zone-signed"
    storage: "/var/lib/knot/zones.signed"
    file: "%s"
    dnssec-signing: on
    semantic-checks: on

  - id: "reverse"
    storage: "/var/lib/knot/zones"
    file: "%s"
    dnssec-signing: off
    semantic-checks: on
    module: mod-queryacl/redacted-networks

  - id: "reverse-signed"
    storage: "/var/lib/knot/zones.signed"
    file: "%s"
    dnssec-signing: on
    semantic-checks: on
    module: mod-queryacl/redacted-networks

# vim:set ts=2 sts=2 sw=2 ai et syntax=yaml:

        … but that won't help:

        root@f-dns1:~# knotc conf-import /tmp/knot-conf-init 
error: config, file '/tmp/knot-conf-init', line 9, unknown module 'mod-queryacl'
error: import (invalid item)

        Greetings Frank

      • Daniel Salzman
        Daniel Salzman @dsalzman ·
        Owner

        @fmatthiess you are right. It's a problem in the configuration import (running server with the config file is not affected). I'm going to investigate it...

      • Daniel Salzman assigned to @dsalzman

        assigned to @dsalzman

      • Daniel Salzman added bug utilities labels

        added bug utilities labels

      • Ghost User
        Ghost User @ghost ·
        Author Contributor

        Hello Daniel,

        as a workaround, i place the initial knot.conf in /etc/knot. this leads to a valid running config:

        root@f-dns1:~# knotc conf-read
server.listen = 0.0.0.0@53 ::@53
log.target = syslog
log[syslog].any = info
template.id = default
template[default].storage = /var/lib/knot/zones
template[default].file = %s
template[default].semantic-checks = on
template[default].dnssec-signing = off
template[default].global-module = mod-cookies/default
template.id = reverse
template[reverse].storage = /var/lib/knot/zones
template[reverse].file = %s
template[reverse].semantic-checks = on
template[reverse].dnssec-signing = off
template.id = reverse-rfc1918
template[reverse-rfc1918].storage = /var/lib/knot/zones
template[reverse-rfc1918].file = %s
template[reverse-rfc1918].semantic-checks = on
template[reverse-rfc1918].dnssec-signing = off
template[reverse-rfc1918].module = mod-queryacl/redacted-networks
template.id = reverse-rfc1918-signed
template[reverse-rfc1918-signed].storage = /var/lib/knot/zones.signed
template[reverse-rfc1918-signed].file = %s
template[reverse-rfc1918-signed].semantic-checks = on
template[reverse-rfc1918-signed].dnssec-signing = on
template[reverse-rfc1918-signed].module = mod-queryacl/redacted-networks
template.id = reverse-signed
template[reverse-signed].storage = /var/lib/knot/zones.signed
template[reverse-signed].file = %s
template[reverse-signed].semantic-checks = on
template[reverse-signed].dnssec-signing = on
template.id = zone-signed
template[zone-signed].storage = /var/lib/knot/zones.signed
template[zone-signed].file = %s
template[zone-signed].semantic-checks = on
template[zone-signed].dnssec-signing = on
mod-cookies.id = default
mod-cookies[default].secret-lifetime = 108000
mod-cookies[default].badcookie-slip = 3
mod-queryacl.id = redacted-networks
mod-queryacl[redacted-networks].address = 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16

        Greetings Frank

      • Daniel Salzman
        Daniel Salzman @dsalzman ·
        Owner

        Fixed in bc4d8f19 (bad issue number in the commit)

      • Daniel Salzman closed

        closed

      • Daniel Salzman mentioned in commit 8aa9b816

        mentioned in commit 8aa9b816

      • Daniel Salzman
        Daniel Salzman @dsalzman ·
        Owner

        @fmatthiess could you try out a patched (https://gitlab.labs.nic.cz/knot/knot-dns/commit/8aa9b8166ec2ec6f44d8b5cba47ed848a9dc990f) package from https://launchpad.net/~cz.nic-labs/+archive/ubuntu/knot-dns-experimental?

      • Ghost User
        Ghost User @ghost ·
        Author Contributor

        Hi Daniel,

        now it works as expected. The config is imported flawlessly. Thank you for your fast reaction and the fix.

        greetings Frank.

      Please register or sign in to reply