Repository navigation
Conversation
Switching the cPanel box to BIND and rerunning the installer broke DNS. The
insert was:
sed -i "/^[[:space:]]*};/i\\ also-notify { IP; };"
which writes before *every* closing brace in the file. cPanel ships a
named.conf with three views and a logging block, so also-notify landed inside
logging and inside a log channel:
/etc/named.conf:30: unknown option 'also-notify'
/etc/named.conf:34: unknown option 'also-notify'
named stopped answering, and the installer printed "[+] BIND configured and
reloaded". On a flat named.conf with one block the same code looked correct,
which is why it survived.
Also, cPanel's ACL is quoted — `allow-transfer { "none"; };` — and the code
stripped only an unquoted `none;`, leaving `{ IP; "none"; }`.
- the insert is bounded to the options block, as DirectAdmin already did
- the quoted "none" is removed too, in all three installers
- after editing, named-checkconf decides: a config it rejects is restored from
the backup and reported, instead of reloading and claiming success
Verified against the real cPanel named.conf, kept as a fixture: one
also-notify in options, logging untouched, named-checkconf clean.
tests/test_named_conf_edit.sh asserts, for every installer that edits
named.conf: the insert is bounded to options, a quoted "none" is removed, the
config is verified, a broken one is reported, and the backup is restored.
Lower bound of 3 installers.
The test asserted the shape of a sed command and left the fixture unused — checking the wording instead of the lock, and the fixture was the one thing that reproduced the failure. The edit is now a function, configure_named_axfr, that the test extracts from each installer and applies to a copy of the real cPanel named.conf: exactly one allow-transfer and one also-notify, both inside options, nothing in logging or any view, no leftover "none", braces balanced, and named-checkconf clean where it is available. The greps stay as cheap checks that the reload is gated. Making it callable also made it portable: sed -i and \? are GNU-only, and on BSD the old commands silently produced 'talso-notify' and left the quoted "none" in place. The insert is awk now, bounded to the options block. Mutations: the original unbounded sed writes also-notify 13 times, into logging and into a view — 3 red; not stripping "none" — 1 red; replacing 'if named-checkconf' with 'if true' — 1 red, after the criterion was narrowed from the word appearing anywhere to it gating the branch.
Edit only the options block of named.conf, and verify the result
Collaborator
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follows the previous release. Switching the cPanel box from PowerDNS to BIND — the one backend path never exercised on a live server — turned up an installer that broke DNS and reported success.
What it did
sed -i "/^[[:space:]]*};/i\\ also-notify { $SECONDARY_IP; };"An insert before every closing brace. cPanel ships a
named.confwith aloggingblock and threeviews, so the directive landed inside logging and inside a log channel:namedstopped answering. The installer printed[+] BIND configured and reloaded.On a flat
named.confthe same code looks right, which is why it survived three panels.Second on the same path: cPanel's ACL is quoted,
allow-transfer { "none"; };, and only an unquotednone;was stripped — leaving{ IP; "none"; }.In this release
optionsblock, in cPanel and Plesk (DirectAdmin already did this)"none"is removed everywherenamed-checkconfbefore reporting anything, and restores the backup from a config named cannot parse. Third time this cycle an installer claimed success over a service it had just broken — the other two were fixed in Restart PowerDNS instead of reloading it, and notice when it stays down #89configure_named_axfr, shared by the three installerssed -iand\?are GNU-only and produced different, silently wrong output on BSDTest
tests/test_named_conf_edit.shapplies the function to a copy of the real cPanelnamed.conf, kept as a fixture, and asserts oneallow-transferand onealso-notify, both insideoptions, nothing inloggingor anyview, no leftover"none", balanced braces, andnamed-checkconfclean.Mutation with the original unbounded
sed: 13 inserts, into logging and into a view.Verified live
The cPanel server now runs BIND with the correct
allow-transfer,named-checkconfclean, and the zone answering from the secondary.