Subject: ISC BIND does not listen on IPv6 address
From: Christian Recktenwald <kernel@lihas.de>
Date: Sat, 29 Oct 2016 11:55:43 +0200

I recently added an IPv6 address to a vserver running BIND.

But BIND doesn't mind.

Using  "strace -s 1500 -o /tmp/trc -f named -d 10 -p 54 -f -g"
I found out it opened /proc/net/if_inet6 and just ignored IPv6 afterwards.
(using port 54 here to not interfere with the productive dns)

So I added interface lo - ::1 - /128 in /etc/vservers . 

Now I get 
	29-Oct-2016 10:49:06.912 using default UDP/IPv4 port range: [1024, 65535]
	29-Oct-2016 10:49:06.912 using default UDP/IPv6 port range: [1024, 65535]
	29-Oct-2016 10:49:06.913 listening on IPv4 interface lo, 127.0.0.1#54
	29-Oct-2016 10:49:06.913 listening on IPv4 interface eth0:0, 212.9.165.46#54

so I'm missing something like 
	listening on IPv6 interface eth0<*>, 2001:14b0:203:4000::6e73#54


Other stuff:

BIND compiled with "--enable-ipv6"

"listen-on-v6 { any; };" is set, changing it to "listen-on-v6 { 2001:14b0:203:4000::6e73;
};"
does not change anything.

/etc/default/bind9 is
	OPTIONS=""

netstat -tulpen
	Active Internet connections (only servers)
	Proto Recv-Q Send-Q Local Address           Foreign Address         State       User
      Inode       PID/Program name
	tcp        0      0 212.9.165.46:53         0.0.0.0:*               LISTEN      0 
        13771626    21924/named     
	tcp        0      0 127.0.0.1:53            0.0.0.0:*               LISTEN      0 
        13771624    21924/named     
	tcp        0      0 212.9.165.46:54         0.0.0.0:*               LISTEN      0 
        13932904    22117/named     
	tcp        0      0 127.0.0.1:54            0.0.0.0:*               LISTEN      0 
        13932902    22117/named     
	tcp        0      0 127.0.0.1:953           0.0.0.0:*               LISTEN      0 
        13771627    21924/named     
	tcp6       0      0 ::1:953                 :::*                    LISTEN      0 
        13771628    21924/named     
	udp        0      0 212.9.165.46:53         0.0.0.0:*                           0 
        13771625    21924/named     
	udp        0      0 127.0.0.1:53            0.0.0.0:*                           0 
        13771623    21924/named     
	udp        0      0 212.9.165.46:54         0.0.0.0:*                           0 
        13932903    22117/named     
	udp        0      0 127.0.0.1:54            0.0.0.0:*                           0 
        13932901    22117/named     
	udp6       0      0 :::35767                :::*                                0 
        13933799    22117/named     

Inside the vserver I can set up 
	echo "ACK" | nc -6 -l -p 54  -v 
and run
	nc 2001:14b0:203:4000::6e73 54
from 
	- the vserver itself
	- the vhost
	- a completely different piece of hardware
and get my "ACK".

The listener can't be launched on port 53 as long as BIND runs:
	nc: Address already in use
which is quite fine and indicates the port is held open by BIND.

I can run (vserver):
	nc -6 -l -p 53 -u -v
and try from outside 
	dig @2001:14b0:203:4000::6e73 soa uoduouvfdouvdf +short
with the result of
	Listening on [:::] (family 10, port 53)
	�9 uoduouvfdouvdf)�9 uoduouvfdouvdf)�9 uoduouvfdouvdf)

so, the communication on IPv6 port 53/udp just works fine.

At last I tried 
	strace -s 200 -f named -p 54 -f -g
and 
	dig @2001:14b0:203:4000::6e73 soa uoduouvfdouvdf +short -p 54
result:
	absolutely no reaction on the BIND side.

-- 
LiHAS - Adrian Reyer - Hessenwiesenstraße 10 - D-70565 Stuttgart
Fon: +49 (7 11) 78 28 50 90 - Fax:  +49 (7 11) 78 28 50 91
Mail: lihas@lihas.de - Web: http://lihas.de
Linux, Netzwerke, Consulting & Support - USt-ID: DE 227 816 626 Stuttgart