Bug#658201: bind9: Does not listen on IPv6 address (at least on kFreeBSD)

[Christoph Egger <christoph@debian.org>]

Package: bind9
Version: 1:9.8.1.dfsg.P1-2
Severity: important

Hi!

  Running bind9 here as both, recursor and authoritive server for some
zones. bind is flawlessly serving on the IPv4 addresses of this
host. However it silently fails to answer any requests over IPv6. Same
configuration worked on squeeze/linux

Regards

  Christoph

-- System Information:
Debian Release: wheezy/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable'), (1, 'experimental')
Architecture: kfreebsd-i386 (i386)

Kernel: kFreeBSD 8.3-0-686
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages bind9 depends on:
ii  adduser                        3.113
ii  bind9utils                     1:9.8.1.dfsg.P1-2
ii  debconf [debconf-2.0]          1.5.41
ii  freebsd-net-tools [net-tools]  8.2+ds3-2
ii  libbind9-80                    1:9.8.1.dfsg.P1-2
ii  libc0.1                        2.13-24
ii  libdns81                       1:9.8.1.dfsg.P1-2
ii  libgssapi-krb5-2               1.10+dfsg~beta1-2
ii  libisc83                       1:9.8.1.dfsg.P1-2
ii  libisccc80                     1:9.8.1.dfsg.P1-2
ii  libisccfg82                    1:9.8.1.dfsg.P1-2
ii  liblwres80                     1:9.8.1.dfsg.P1-2
ii  libssl1.0.0                    1.0.0g-1
ii  libxml2                        2.7.8.dfsg-5.1
ii  lsb-base                       3.2-28
ii  netbase                        4.47

bind9 recommends no packages.

Versions of packages bind9 suggests:
pn  bind9-doc   <none>
pn  dnsutils    1:9.7.3.dfsg-1+b1
pn  resolvconf  <none>
pn  ufw         <none>

-- Configuration Files:
/etc/bind/named.conf.local changed:

// Some local zones here

/etc/bind/named.conf.options changed:
key "rndc-key" {
      algorithm hmac-md5;
      secret "zvuebvW0duvNWqW0z7s/SA==";
};
controls {
      inet 127.0.0.1 port 953
              allow { 127.0.0.1; } keys { "rndc-key"; };
};
options {
        directory "/var/cache/bind";
	// from bind 9:
	// 	[fetch-glue] is obsolete. In BIND 8, fetch-glue yes caused the
	//	server to attempt to fetch glue resource records it didn't have
	//	when constructing the additional data section of a response.
	//	This is now considered a bad idea and BIND 9 never does it.
	//	fetch-glue no;
	listen-on-v6 port 53 { 
		2001:a60:f000:26::2; 
		2001:a60:f01c:0:70:ff:1:0;
	};
//	recursion no;
	allow-recursion { 
		10.0.0.0/8; 
		2001:a60:f01c::/48;
		127.0.0.0/8;
	};
	// If there is a firewall between you and nameservers you want
	// to talk to, you might need to uncomment the query-source
	// directive below.  Previous versions of BIND always asked
	// questions using port 53, but BIND 8.1 and later use an unprivileged
	// port by default.
	query-source address * port 53;
	// If your ISP provided one or more IP addresses for stable 
	// nameservers, you probably want to use them as forwarders.  
	// Uncomment the following block, and insert the addresses replacing 
	// the all-0's placeholder.
	forwarders {
		212.114.152.1;
		212.114.153.1;
	};
};


-- debconf information:
  bind9/different-configuration-file:
  bind9/run-resolvconf: true
  bind9/start-as-user: bind