BIND 问题：nsupdate 无法更新反向区域

Question

我正在使用 测试我的 ddns 更新配置（用于托管在同一服务器上的 ISC DHCP）nsupdate，并且当转发区域正确更新时：

    # nsupdate
    > server 127.0.0.1
    > key dhcpupdate MYSECRETKEY
    > update add test.example.com. 600 IN A 10.2.2.45
    > send
    # tail -n1 /var/log/named.conf
    client 127.0.0.1#12584: view internal: updating zone 'example.com/IN': adding an RR at 'test.example.com' A

反向区域不会：

    # nsupdate
    > server 127.0.0.1
    > key dhcpupdate MYSECRETKEY
    > update add 45.2.2.10.in-addr.arpa. 600 IN PTR test.example.com.
    > send
    response to SOA query was unsuccessful

然后 nsupdate 将我吐回外壳，并且日志中没有错误（或任何类型的消息）。我已经尝试过带和不带尾随周期的反向区域更新。我觉得我错过了一些基本的东西，但我无法弄清楚它是什么。

感谢您的指点。这是我的配置文件和其他信息：

# cat /etc/named.conf

acl internals {
    127.0.0.0/8;
    10.2.2.0/24;
};

logging {
    channel named.log {
            file "/var/log/named/named.log";
            severity dynamic;
    };
    category default {
            named.log;
    };
};

options {
    listen-on port 53 { any; };
    // listen-on-v6 port 53 { ::1; };
    directory       "/var/named";
    dump-file       "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    allow-query     { any; };
    recursion no;

    dnssec-enable yes;
    dnssec-validation yes;
    dnssec-lookaside auto;

    /* Path to ISC DLV key */
    bindkeys-file "/etc/named.iscdlv.key";

    managed-keys-directory "/var/named/dynamic";
};

key dhcpupdate {
    algorithm hmac-md5;
    secret "MYSECRETKEY";
};

include "/etc/named.root.key";

view "internal" {
    match-clients { internals; };
    recursion yes;
    zone "localhost" IN {
            type master;
            file "/var/named/db.localhost";
            allow-update { none; };
    };
    zone "0.0.127.in-addr.arpa" IN {
            type master;
            file "/var/named/db.0.0.127.in-addr.arpa";
            allow-update { none; };
    };
    zone "." IN {
            type hint;
            file "named.ca";
    };
    zone "example.com" {
            type master;
            file "/var/named/db.example.com";
            allow-update { key dhcpupdate; };
    };
    zone "2.2.10.in-addr.arpa" IN {
            type master;
            file "/var/named/db.2.2.10.in-addr.arpa";
            allow-update { key dhcpupdate; };
    };
};

view "external" {
    match-clients { any; };
    recursion no;
    forwarders { 1.2.3.4; 1.2.3.5; }; // ISP DNS servers
    forward first;
};

# cat /var/named/db.example.com

$ORIGIN .
$TTL 600        ; 10 minutes
example.com     IN SOA  ns1.example.com. root.example.com. (
                                5          ; serial
                                604800     ; refresh (1 week)
                                86400      ; retry (1 day)
                                2419200    ; expire (4 weeks)
                                604800     ; minimum (1 week)
                                )
                        NS      ns1.example.com.
                        A       10.2.2.44
$TTL 3600       ; 1 hour
                        MX      1 ASPMX.L.GOOGLE.COM.
                        MX      5 ALT1.ASPMX.L.GOOGLE.COM.
                        MX      5 ALT2.ASPMX.L.GOOGLE.COM.
                        MX      10 ASPMX2.GOOGLEMAIL.COM.
                        MX      10 ASPMX3.GOOGLEMAIL.COM.
$ORIGIN example.com.
$TTL 600        ; 10 minutes
myserver                A       10.2.2.5
ns1                     A       10.2.2.5
test                    A       10.2.2.45
www                     A       123.12.34.32 // externally hosted www server

# cat /var/named/db.2.2.10.in-addr.arpa

;
; BIND data file for example.com
;
$TTL 10m
@  IN  SOA ns1.example.com. root.example.com. (
            2           ; Serial
            604800      ; Refresh
            86400       ; Retry
            2419200     ; Expire
            604800 )    ; Negative Cache TTL
;
2.2.10.in-addr.arpa.    IN      NS      ns1.example.com.
5                       IN      PTR     myserver.example.com.

编辑：

在 nsupdate 中使用 debug 命令给出以下内容：

Reply from SOA query:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id:  28411
;; flags: qr ra; QUESTION: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; QUESTION SECTION:
;96.2.2.10.in-addr.arpa.                IN      SOA

;; TSIG PSEUDOSECTION:
dhcpupdate.             0       ANY     TSIG    hmac-md5.sig-alg.reg.int. 1367446210 300 16 XXXXXXXXX 28411 NOERROR 0

response to SOA query was unsuccessful

编辑2：

指定区域时，我得到以下信息：

> debug
> server 127.0.0.1
> zone 2.2.10.in-addr.arpa
> key dhcpupdate XXXXXXXXXXX
> update add 96.2.2.10.in-addr.arpa. 600 IN PTR scott-lap.example.com.
> send
Sending update to 127.0.0.1#53
Outgoing update query:
;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id:  11170
;; flags:; ZONE: 1, PREREQ: 0, UPDATE: 1, ADDITIONAL: 1
;; ZONE SECTION:
;2.2.10.in-addr.arpa.           IN      SOA

;; UPDATE SECTION:
96.2.2.10.in-addr.arpa. 600     IN      PTR     scott-lap.example.com.

;; TSIG PSEUDOSECTION:
dhcpupdate.             0       ANY     TSIG    hmac-md5.sig-alg.reg.int. 1367447008 300 16 XXXXXXXXXXXXXX 11170 NOERROR 0


Reply from update query:
;; ->>HEADER<<- opcode: UPDATE, status: SERVFAIL, id:  11170
;; flags: qr ra; ZONE: 1, PREREQ: 0, UPDATE: 0, ADDITIONAL: 1
;; ZONE SECTION:
;2.2.10.in-addr.arpa.           IN      SOA

;; TSIG PSEUDOSECTION:
dhcpupdate.             0       ANY     TSIG    hmac-md5.sig-alg.reg.int. 1367447008 300 16 XXXXXXXXXXXXXXXXX 11170 NOERROR 0

编辑3：

呵呵。我正在尝试使用host它来查看它是否解析了我的 DNS 服务器的 ip 地址（在上面的反向区域文件中列出），这就是我得到的。再次没有日志条目。

# host -v 10.2.2.5
Trying "10.2.2.10.in-addr.arpa"
Host 10.2.2.10.in-addr.arpa not found: 2(SERVFAIL)
Received 40 bytes from 10.2.2.5#53 in 0 ms

Answer 1

我有预感，这可能是因为zone您的更新中没有明确的声明。

nsupdate当您省略该更新时，必须猜测更新适用于哪个区域（根据手册页“基于输入的其余部分”），并且考虑到该区域有多少四边形深度，我认为该假设有很大的空间是错误的。

如果做不到这一点，请-v尝试一下，看看您在 TCP 方面是否有更好的运气。