Bug 14044 - samba-tool does not display IPV6 PTR records properly
Summary: samba-tool does not display IPV6 PTR records properly
Status: NEW
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: AD: LDB/DSDB/SAMDB (show other bugs)
Version: 4.13.3
Hardware: x64 Linux
: P5 normal (vote)
Target Milestone: ---
Assignee: Kai Blin
QA Contact: Samba QA Contact
Depends on:
Reported: 2019-07-22 23:57 UTC by Russell Thamm
Modified: 2020-12-29 12:29 UTC (History)
2 users (show)

See Also:


Note You need to log in before you can comment on or make changes to this bug.
Description Russell Thamm 2019-07-22 23:57:49 UTC
samba-tool and RSAT DNS do not display IPv6 PTR records properly. I have seen this using samba 4.8.0 and 4.10.4 running on CentOS 7 with internal DNS.

[root@bilbo user]# samba-tool dns add localhost 4.e.7.c.9.3.0.b. PTR brutus.dev.local
Password for [administrator@DEV.LOCAL]:
Record added successfully

[root@bilbo user]# nslookup fd87:0674:b039:c7e4::55
Address:	name = brutus.dev.local.

[root@bilbo user]# samba-tool dns query localhost 4.e.7.c.9.3.0.b. @ PTR
Password for [administrator@DEV.LOCAL]:
  Name=, Records=0, Children=0
  Name=0, Records=0, Children=1

For the above record, RSAT DNS shows a folder labeled 0.

To view the PTR records, I have to use ldbsearch.

ldbsearch -H /usr/local/samba/private/sam.ldb -b "DC=DomainDnsZones,DC=dev,DC=local" "(objectclass=dnsNode)" --show-binary

# record 50
dn: DC=,DC=4.e.7.c.9.3.0.b.,CN=MicrosoftDNS,DC=DomainDnsZones,DC=dev,DC=local
objectClass: top
objectClass: dnsNode
instanceType: 4
whenCreated: 20190718060248.0Z
whenChanged: 20190718060248.0Z
uSNCreated: 117101
uSNChanged: 117101
showInAdvancedViewOnly: TRUE
objectGUID: 674f6822-4a99-4f24-bfd5-4b2fe1308826
dnsRecord:     NDR: struct dnsp_DnssrvRpcRecord
        wDataLength              : 0x0014 (20)
        wType                    : DNS_TYPE_PTR (12)
        version                  : 0x05 (5)
        rank                     : DNS_RANK_ZONE (240)
        flags                    : 0x0000 (0)
        dwSerial                 : 0x0000000b (11)
        dwTtlSeconds             : 0x00000384 (900)
        dwReserved               : 0x00000000 (0)
        dwTimeStamp              : 0x0037fb7e (3668862)
        data                     : union dnsRecordData(case 12)
        ptr                      : brutus.dev.local

objectCategory: CN=Dns-Node,CN=Schema,CN=Configuration,DC=dev,DC=local
distinguishedName: DC=,DC=4.e.7.c.9.3.0.b.,CN=MicrosoftDNS,DC=DomainDnsZones,DC=dev,DC=local
Comment 1 Amit Kumar 2019-09-16 08:04:43 UTC
# samba-tool dns zonecreate localhost test-dns-zone -U Administrator
# samba-tool dns zonelist localhost -U Administrator
  pszZoneName                 : test-dns-zone
  ZoneType                    : DNS_ZONE_TYPE_PRIMARY
  Version                     : 50
  pszDpFqdn                   : DomainDnsZones.samdom.amitexample.com

To keep note for myself, will be working
Comment 2 Amit Kumar 2019-09-24 07:57:08 UTC
1. Added a IPv6 PTR record. zone=test-dns-zone, record-name=ptr-record1
samba-tool dns add -h
Usage: samba-tool dns add <server> <zone> <name> <A|AAAA|PTR|CNAME|NS|MX|SRV|TXT> <data>

# samba-tool dns add localhost test-dns-zone ptr-record1 PTR sambadom.amitexample.com -U Administrator
Record added successfully

2. Wanted to query same PTR record, But cannot find.
# samba-tool dns query localhost test-dns-zone -h
Usage: samba-tool dns query <server> <zone> <name> <A|AAAA|CNAME|MX|NS|SOA|SRV|TXT|ALL> [options]
Query a name.

# samba-tool dns query localhost test-dns-zone ptr-record1 ALL -U Administrator
  Name=, Records=1, Children=0
    PTR: sambadom.amitexample.com (flags=f0, serial=2, ttl=900)

a. samba-tool dns query does not 'PTR' record search command.
b. Also, record entry is not shown by query ALL.
Comment 3 Mikhail 2020-09-28 04:34:07 UTC
Zones "in-addr.arpa" and "ip6.arpa" cannot contain anything other than PTR records.

When a reverse zone is created for network /16 for ipv4 or any net for ipv6, a symbol "dot" appears in the ptr record.

The Samba DNS RPC server is trying to create a hierarchical structure based on symbol "dot" when enumerate records.

The DNS service returns the correct data. But RPC server return wrong data and it is impossible to manage the structure of the DNS either through the Windows applet or through the samba-tool.

Sorry for my English
Comment 4 Björn Jacke 2020-12-21 15:36:40 UTC
(In reply to Mikhail from comment #3)
> Zones "in-addr.arpa" and "ip6.arpa" cannot contain anything other than PTR
> records.

this is not right, also a reverse zone can have other record types than PTR.
For example, if you add another nameserver for the reverse zone, then MMC will ask you to ass a glue record, if you do that, you will not only have an NS record but also an A/AAAA record for the new nameserver being added there, a DN like this:

dn: DC=othernameserver.int.example.de,DC=92.10.in-addr.arpa,CN=MicrosoftDNS,DC=DomainDnsZones,DC=int,DC=example,DC=de

(In MS AD the othernameserver.int.example.de would also have a trailing fqdn ".")

But yes, a valid PTR record would have to be added like this:

samba-tool dns  add dc1 PTR v6host1 -P
Comment 5 Björn Jacke 2020-12-21 15:41:24 UTC
Back the the main problem:

MMC tries to make a query like this:

# ldbsearch -H /var/lib/samba/private/sam.ldb -b "DC=,CN=MicrosoftDNS,DC=DomainDnsZones,DC=int,DC=example,DC=de" '(&(objectClass=dnsNode)(dc=*.0.0.0)(!(dNSTombstoned=TRUE)))'  dc
# returned 0 records

yes, it gives no results ... while with a modified search filer removing the (dc=*.0.0.0):

# ldbsearch -H /var/lib/samba/private/sam.ldb -b "DC=,CN=MicrosoftDNS,DC=DomainDnsZones,DC=int,DC=example,DC=de" '(&(objectClass=dnsNode)(!(dNSTombstoned=TRUE)))'  dc
# record 1
dn: DC=@,DC=,CN=MicrosoftDNS,DC=DomainDnsZones,DC=int,DC=example,DC=de
dc: @

# record 2
dn: DC=,DC=,CN=MicrosoftDNS,DC=DomainDnsZones,DC=int,DC=example,DC=de

# record 3
dn: DC=,DC=,CN=MicrosoftDNS,DC=DomainDnsZones,DC=int,DC=example,DC=de

It looks like we don't correctly handle the LDAP search filter here.