You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@bugzilla.spamassassin.org on 2011/11/30 17:50:40 UTC
[Bug 6712] New: IPv6 DNS Work
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6712
Bug #: 6712
Summary: IPv6 DNS Work
Product: Spamassassin
Version: SVN Trunk (Latest Devel Version)
Platform: PC
OS/Version: Windows 7
Status: NEW
Severity: normal
Priority: P2
Component: sa-update
AssignedTo: dev@spamassassin.apache.org
ReportedBy: kmcgrail@pccc.com
Classification: Unclassified
I've been working over the past few weeks to get the IPv6 infrastructure setup
and we are now testing an IPv6 nameserver (ns3.pccc.com).
If things go as planned, I believe we will need to add this nameserver to the
spamassassin.org zone so that there is an IPv6 resolver in the mix of domain
names.
Then we plan to add a record for AAAA that points to the sa-update.pccc.com
working on IPv6 to get the MIRRORED_BY file so that sa-update can work on a
pure IPv6 network.
This has been mentioned in many discussions/bugs but I believe this will be a
core feature of 3.4.0.
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6712] IPv6 DNS Work
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6712
--- Comment #4 from Mark Martinec <Ma...@ijs.si> 2011-11-30 19:15:32 UTC ---
> The second one you mentioned, updates.spamassassin.org, doesn't even exist
> itself but is the DNS stub for the versioned updates TXT records.
The updates.spamassassin.org needn't be a true host.
It would suffice to give it:
A 140.211.11.131 ( = spamassassin.apache.org )
AAAA 2001:550:2a00:1::2 ( = sa-update.pccc.com )
(assuming sa-update.pccc.com would serve the MIRRORED_BY file)
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6712] IPv6 DNS Work
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6712
Kevin A. McGrail <km...@pccc.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |kmcgrail@pccc.com
Target Milestone|Undefined |3.4.0
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6712] IPv6 DNS Work
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6712
--- Comment #2 from Mark Martinec <Ma...@ijs.si> 2011-11-30 18:13:29 UTC ---
Btw, here is a verbose output of the current sa-update (fresh download):
# sa-update -vv
DNS TXT query: 0.4.3.updates.spamassassin.org -> 1195874
Update available for channel updates.spamassassin.org: -1 -> 1195874
DNS TXT query: mirrors.updates.spamassassin.org ->
http://spamassassin.apache.org/updates/MIRRORED.BY
http: (curl) GET http://spamassassin.apache.org/updates/MIRRORED.BY, success
http: (curl) GET http://daryl.dostech.ca/sa-update/asf/1195874.tar.gz, success
http: (curl) GET http://daryl.dostech.ca/sa-update/asf/1195874.tar.gz.sha1,
success
http: (curl) GET http://daryl.dostech.ca/sa-update/asf/1195874.tar.gz.asc,
success
Update was available, and was downloaded and installed successfully
It seems a bit strange that we query updates.spamassassin.org for an ID of
the latest update, but download MIRRORED.BY from spamassassin.APACHE.ORG .
Wouldn't it make sense to have spamassassin.org or updates.spamassassin.org
capable of also serving MIRRORED.BY ?
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6712] IPv6 DNS Work
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6712
--- Comment #3 from Karsten Bräckelmann <gu...@rudersport.de> 2011-11-30 18:52:59 UTC ---
> It seems a bit strange that we query updates.spamassassin.org for an ID of
> the latest update, but download MIRRORED.BY from spamassassin.APACHE.ORG .
> Wouldn't it make sense to have spamassassin.org or updates.spamassassin.org
> capable of also serving MIRRORED.BY ?
Are there even real machines we could use?
spamassassin.org has address 192.87.106.226
226.106.87.192.in-addr.arpa is an alias for 226.224.106.87.192.in-addr.arpa.
226.224.106.87.192.in-addr.arpa domain name pointer aurora.apache.org.
The web-server for spamassassin.org merely returns 301 Moved Permanently,
pointing at spamassassin.apache.org.
The second one you mentioned, updates.spamassassin.org, doesn't even exist
itself but is the DNS stub for the versioned updates TXT records.
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6712] IPv6 DNS Work
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6712
Darxus <Da...@ChaosReigns.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |Darxus@ChaosReigns.com
--- Comment #8 from Darxus <Da...@ChaosReigns.com> 2012-03-04 18:52:16 UTC ---
What still needs to be done?
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6712] IPv6 DNS Work
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6712
--- Comment #6 from Mark Martinec <Ma...@ijs.si> 2011-11-30 19:41:15 UTC ---
Off topic, but:
> Btw, dealing with IPv4-only RBL servers, the solution is DNS64 + NAT64.
> The DNS64 is running fine (available since bind 9.8), but the NAT64 is
> still giving me hard time.
Sorry, this was not a sensible claim of mine. The IPv4-only RBL servers
are better dealt with by using a separate DNS resolver on a dual-stack
host. I only need NAT64 to access Razor servers (not sure about DCC)
and to be able to fetch SA source update from svn.apache.org.
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6712] IPv6 DNS Work
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6712
--- Comment #7 from Mark Martinec <Ma...@ijs.si> 2011-12-01 20:18:12 UTC ---
> During the past few days I have prepared another fresh node
> with inet6 connectivity only, for testing SpamAssassin. Looks fine.
> I only need NAT64 to access Razor servers (not sure about DCC)
> and to be able to fetch SA source update from svn.apache.org.
>
> The DNS64 is running fine (available since bind 9.8),
> but the NAT64 is still giving me hard time.
Just a short progress report:
Ditched the ecdysis-fedora-14-x86_64-20101117.iso and went for
ecdysis-openbsd-4.6-amd64-20100226.iso on a virtual box, now
finally the NAT64 works!
On an IPv6-only host I'm now able to fetch SpamAssassin sources from SVN!
Also also the bootstraping of MIRRORED.BY works through NAT64.
Can also ssh to people.apache.org .
The t/dcc.t test is successful (just mutters an unnecessary warning
about a broken Razor!? )
The only test (that I know of) that is failing is Razor.
The NAT64 would provide it with a connectivity to an IPv4-only razor
server, but the razor agent perl module is unable to use an inet6 socket
and gives up, claiming that the protocol is not supported:
$ razor-admin -discover -d
[ 5] Connecting to discovery.razor.cloudmark.com ...
[ 3] Unable to connect to discovery.razor.cloudmark.com:2703;
Reason: Protocol not supported.
[ 5] Razor Discovery Server discovery.razor.cloudmark.com is unreachable
All the rest seems fine, all the tests (except razor) pass,
including the long and the network tests:
t/config:
run_long_tests=y
run_net_tests=y
run_dcc_tests=y
run_spamd_prefork_stress_test=y
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6712] IPv6 DNS Work
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6712
Mark Martinec <Ma...@ijs.si> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |FIXED
--- Comment #9 from Mark Martinec <Ma...@ijs.si> 2012-04-24 17:29:25 UTC ---
> What still needs to be done?
Apparently nothing. Closing.
The spamassassin.apache.org now has an IPv6 address:
$ host spamassassin.apache.org
spamassassin.apache.org has address 192.87.106.229
spamassassin.apache.org has address 140.211.11.131
spamassassin.apache.org has IPv6 address 2001:610:1:80bc:192:87:106:229
so everything is fine, even the MIRRORED.BY file can be fetched
on an IPv6-only host.
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6712] IPv6 DNS Work
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6712
--- Comment #5 from Karsten Bräckelmann <gu...@rudersport.de> 2011-11-30 19:32:12 UTC ---
(In reply to comment #4)
> > The second one you mentioned, updates.spamassassin.org, doesn't even exist
> > itself but is the DNS stub for the versioned updates TXT records.
>
> The updates.spamassassin.org needn't be a true host.
> It would suffice to give it:
> A 140.211.11.131 ( = spamassassin.apache.org )
And have the ASF infra team host another name-based virtual host. That would
do, but it needs to be some host at least...
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6712] IPv6 DNS Work
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6712
--- Comment #1 from Mark Martinec <Ma...@ijs.si> 2011-11-30 17:53:26 UTC ---
> I've been working over the past few weeks to get the IPv6 infrastructure setup
> and we are now testing an IPv6 nameserver (ns3.pccc.com).
Very nice to hear.
> If things go as planned, I believe we will need to add this nameserver to the
> spamassassin.org zone so that there is an IPv6 resolver in the mix of domain
> names.
We may, but it is not a requirement. Seems like the three slave DNS servers
at sonic.net for domain spamassassin.org already have dual-stack connectivity:
$ host -t ns spamassassin.org
spamassassin.org name server a.auth-ns.sonic.net.
spamassassin.org name server c.auth-ns.sonic.net.
spamassassin.org name server b.auth-ns.sonic.net.
spamassassin.org name server ns.hyperreal.org.
$ host a.auth-ns.sonic.net
a.auth-ns.sonic.net has address 209.204.159.20
a.auth-ns.sonic.net has IPv6 address 2001:5a8:0:3::1
$ host b.auth-ns.sonic.net
b.auth-ns.sonic.net has address 184.173.92.18
b.auth-ns.sonic.net has IPv6 address 2607:f0d0:1102:f::2
$ host c.auth-ns.sonic.net
c.auth-ns.sonic.net has address 69.9.186.104
c.auth-ns.sonic.net has IPv6 address 2001:48c8:1:1::2
The ns.hyperreal.org is still IPv4-only, but that doesn't matter.
> Then we plan to add a record for AAAA that points to the sa-update.pccc.com
> working on IPv6 to get the MIRRORED_BY file so that sa-update can work on a
> pure IPv6 network.
Yes, this is still needed. It is the only reason preventing sa-update
from bootstraping on such node. Perhaps it is now the time do this step.
Existing/old sa-update won't notice the AAAA record, the new sa-update
will take advantage of it when possible/necessary.
During the past few days I have prepared another fresh node with inet6
connectivity only for testing SpamAssassin. Looks fine.
Btw, dealing with IPv4-only RBL servers, the solution is DNS64 + NAT64.
The DNS64 is running fine (available since bind 9.8), but the NAT64 is
still giving me hard time.
Is anything else besides MIRRORED.BY tied to spamassassin.apache.org ?
So, is everybody happy about adding AAAA to spamassassin.apache.org,
pointing to 2001:550:2a00:1::2 ( = www.sa-update.pccc.com) ?
Or do we bug infra again about the progress in making apache.org
dual stacked.
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.