Bug 1912556

Summary:	Incorrect DNSKEY created when DNSSEC enabled for zone
Product:	Red Hat Enterprise Linux 8	Reporter:	Tomasz Kepczynski <tomek>
Component:	ipa	Assignee:	Thomas Woerner <twoerner>
Status:	CLOSED ERRATA	QA Contact:	ipa-qe <ipa-qe>
Severity:	medium	Docs Contact:
Priority:	high
Version:	8.3	CC:	frenaud, mpolovka, pcech, rcritten, ssidhaye, tscherf
Target Milestone:	rc	Keywords:	TestCaseProvided, Triaged
Target Release:	8.0	Flags:	pm-rhel: mirror+
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	ipa-4.9.3-1	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-09 18:21:53 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Tomasz Kepczynski 2021-01-04 18:33:15 UTC

Description of problem:
When DNSSEC is enabled for the zone two DNSKEYs should be created for the zone: one KSK key (for trust chain connection from upper level zone) and one ZSK key for record signing.
Currently two KSK DNSKEYs are created.

Version-Release number of selected component (if applicable):
ipa-selinux-4.8.7-12.module_el8.3.0+511+8a502f20.noarch
ipa-server-dns-4.8.7-12.module_el8.3.0+511+8a502f20.noarch
ipa-common-4.8.7-12.module_el8.3.0+511+8a502f20.noarch
ipa-client-4.8.7-12.module_el8.3.0+511+8a502f20.x86_64
ipa-healthcheck-core-0.4-6.module_el8.3.0+482+9e103aab.noarch
ipa-server-common-4.8.7-12.module_el8.3.0+511+8a502f20.noarch
ipa-server-4.8.7-12.module_el8.3.0+511+8a502f20.x86_64
ipa-server-trust-ad-4.8.7-12.module_el8.3.0+511+8a502f20.x86_64
ipa-client-common-4.8.7-12.module_el8.3.0+511+8a502f20.noarch

How reproducible:
Probably always. Visible in 5 different zones (not yet exposed on the Internet).

Steps to Reproduce:
1. Create zone as usual.
2. Enable DNSSEC: ipa dnszone-mod <zonename> --dnssec=true
3. Enable NSEC3:  ipa dnszone-mod <zonename> --nsec3param-rec="1 1 10 $(xxd -ps -l8 -u /dev/urandom)"

Actual results:
2 KSKs attached to the zone.

Expected results:
1 KSK and 1 ZSK attached to the zone.

Additional info:
Key listing from opendnssec:
filippa:~# SOFTHSM2_CONF=/etc/ipa/dnssec/softhsm2.conf ods-enforcer key list -v -z <xxx>.eu
Keys:
Zone:                           Keytype: State:    Date of next transition: Size: Algorithm: CKA_ID:                          Repository: KeyTag:
<xxx>.eu                        KSK      publish   2021-01-05 08:43:35      3072  8          820cd89ce8c3bc9d191e6f1afc664fe4 SoftHSM     36710
<xxx>.eu                        ZSK      ready     2021-01-05 08:43:35      2048  8          250d09a4724d46676e4b7fe0b77eb9ba SoftHSM     24045

Please note keytypes in the listing above: 1 KSK & 1 ZSK.

dig output:
filippa:~# dig <xxx>.eu dnskey +short +rrcomments
257 3 8 AwEAAbv1+PERvOibE315J7G0z6X9G/gXzCYQjO53E1jawFy+Jskg/aQ8 A5o5cWlR8ip5z4TLH1qwRUznvbZAWUNi26EqSCLL/oEYLfl8ibexRWip 5i12D1lxPtl4j6rYDUMeLmu7Nmt6uMRyG8FmzwKKmNLG76U4EJTjGgO+ 7xdDzU9U6pppwxJD3RCeuYFHn78pxsNwnEOYo5ICOCXCHuTZw6YWq1oH JY+nuzBhtFlU82T4p2MoqvNlfRjd+85yIgJVImvXpyMLWBTVcgpv1goY nb3wF3LMlWJU8wZVLTXuJjQrXWyfnrATzGe7lKmMRNxhtvGoEXAmRjFP 4auS74Oh1SE=  ; KSK; alg = RSASHA256 ; key id = 24046
257 3 8 AwEAAcCeLyVFPsCDR2b8q1cB4O+qPzroVdyN56/SseHPFwHsEXwHqbOD HKWKl8inUc2fDK0rboPP0CrMxxTDWC+JDY4CCqGZcYO8YeIR04BRb9A9 IiCvtWvxBo8qNhLvDGFhFaUHVWIsJfBl+PtkgmbbwGZ6k7JuO1vnxCVc sP9ZvLfFqdj6CeIGhCmISKTZ/iNYIX4hZ1o7NrYhD+o6d+f3v69Q8Q9F 8aTUeG5KwDPlYQMMyI6SxKaSO1lR/8DrCAdn7KOMW6hZmB9b+l5t4RrW /eJ76DlISHGpxZTUkXGRDKah6yGpDK0CyQRa8uUPsQ6WJ3V/xyWF0SJ1 0HRPk3OwgqUm6iSukOdBIgIb6Gfrtxpsi6VkLiq2QDGOFou6RD7F5ddU tvlao+AWrnQ75HqyHvvzjtYHEXTsBCXb+9oWEDi0jfaFlKVeO+xmKKd5 6NuzBAwzSRsgtucxAqjB+IB6Yt8DEW+jaH7J10NUkeMiQEFD/hW26Gsg DdaZIZaLTI2Ihw==  ; KSK; alg = RSASHA256 ; key id = 36710

Please note BOTH keys are marked as KSK (both in comments and by keyflags in the first field: 257).

Comment 1 Florence Blanc-Renaud 2021-01-07 07:13:33 UTC

This is a valid issue, reproducer provider in the summary.
Present since the migration to OpenDNSSEC 2.1.

Comment 2 Florence Blanc-Renaud 2021-01-07 07:19:05 UTC

Upstream ticket:
https://pagure.io/freeipa/issue/8647

Comment 4 Florence Blanc-Renaud 2021-02-04 13:23:29 UTC

Fixed upstream
master:
https://pagure.io/freeipa/c/cdfc86364ee2eed2aafda2e8b3a484a7a264677e
https://pagure.io/freeipa/c/7902c784963c64b2d0fba8e7fa03529e793c221c
https://pagure.io/freeipa/c/ca17a81a30cc83568008bad9031db3b8c6b90f2f

Test case added upstream in ipatests/test_integration/test_dnssec.py::TestInstallDNSSECLast::test_key_types

Comment 5 Florence Blanc-Renaud 2021-02-05 08:07:50 UTC

Fixed upstream
ipa-4-9:
https://pagure.io/freeipa/c/44762369fb05b67855a8dc81d647c8880d642902
https://pagure.io/freeipa/c/dd21d068cb4500b0d8a8af14b0371f95cc40c974
https://pagure.io/freeipa/c/2a51892ab9688b6bc5282098a426003932462549

Comment 10 Michal Polovka 2021-06-11 09:35:35 UTC

Verified using automated test ipatests/test_integration/test_dnssec.py::TestInstallDNSSECLast

Verified version: 4.9.3-1.module+el8.5.0+10565+ae980a94

Test output:
Passed 	test_integration/test_dnssec.py::TestInstallDNSSECLast::()::test_key_types

Marking as verified.

Comment 11 Rob Crittenden 2021-06-20 05:17:16 UTC

*** Bug 1973951 has been marked as a duplicate of this bug. ***

Comment 13 errata-xmlrpc 2021-11-09 18:21:53 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (ipa bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:4230