Bug 2006762

Summary:	RFE: systemd-resolved: add a way to disable synthetic RR generation
Product:	Red Hat Enterprise Linux 9	Reporter:	François Cami <fcami>
Component:	systemd	Assignee:	Jacek Migacz <jmigacz>
Status:	CLOSED ERRATA	QA Contact:	Frantisek Sumsal <fsumsal>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	9.0	CC:	antorres, extras-qa, fedoraproject, filbranden, flepied, jamacku, jmigacz, lnykryn, msekleta, rjeffman, ssahani, s, systemd-maint-list, systemd-maint, yuwatana, zbyszek
Target Milestone:	rc	Keywords:	FutureFeature, Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	systemd-252-3.el9	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	2006761	Environment:
Last Closed:	2023-05-09 08:21:58 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2006761, 2138081
Bug Blocks:

Description François Cami 2021-09-22 11:05:44 UTC

+++ This bug was initially created as a clone of Bug #2006761 +++

Description of problem:

systemd-resolved always (reverse)-resolves the host's IP addresses and FQDN.
This can be harmful when an application (for instance, a DNS zone manager) is installed on the same server instance.
That application would expect NXDOMAIN to be returned if the current server's IP does not belong in an already managed reverse zone.

More details:
https://lists.freedesktop.org/archives/systemd-devel/2021-September/046856.html


How reproducible:

Always, see list post.



Expected results:

Being able to disable the generation of synthetic RRs.


Additional info:

The workarounds described in the mailing-list all imply changing the application in a more or less intrusive or fragile way. Being able to change resolved's behavior in its configuration file would be much more efficient.

Comment 8 Jacek Migacz 2022-03-11 19:11:01 UTC

Hi François,

with systemd 250, there is a $SYSTEMD_NSS_RESOLVE_SYNTHESIZE for resolvers using libnss.

Just a quick recap, for the systemd 250 host with address 192.168.254.2:

SYSTEMD_NSS_RESOLVE_SYNTHESIZE=1 getent -s hosts:resolve hosts 192.168.254.2; echo $?
192.168.254.2   host2006762 host2006762.local
0

[root@host2006762 ~]# SYSTEMD_NSS_RESOLVE_SYNTHESIZE=0 getent -s hosts:resolve hosts 192.168.254.2; echo $?
2

Looking at a sibling Bug 2006761, I propose to close this bug.

Comment 9 François Cami 2022-03-11 19:22:53 UTC

Hi Jacek,

I created the RHEL9 bug to make sure that systemd-resolved would not be shipped in RHEL9 without this fix.
I'll defer to Antonio (CC'd) to decide whether closing is acceptable for FreeIPA/Identity Management.

Thanks!
François

Comment 11 Jan Macku 2023-01-24 12:47:23 UTC

This issue should be fixed via rebase to systemd v252.

Comment 16 errata-xmlrpc 2023-05-09 08:21:58 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (systemd bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:2531