Bug 2067270

Summary:	dnsmasq fails validation on GOSTHASH digests
Product:	[Fedora] Fedora	Reporter:	Petr Menšík <pemensik>
Component:	dnsmasq	Assignee:	Petr Menšík <pemensik>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	37	CC:	aegorenk, code, dns-sig, dougsland, pemensik, veillard
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
URL:	https://rootcanary.org/test.html
Whiteboard:
Fixed In Version:	dnsmasq-2.88-1.fc38 dnsmasq-2.88-1.fc37	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	2067273 (view as bug list)		Environment:
Last Closed:	2023-01-03 01:24:30 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2150667
Bug Blocks:	2067273

Description Petr Menšík 2022-03-23 17:18:10 UTC

Description of problem:
When dnssec validation is enabled and trust anchor filled, dnsmasq does not pass all algorithms on rootcanary.org/test. Digest 3(gosthash94) fails with SERVFAIL instead of INSECURE. Nettle on Fedora/RHEL has GOST implementation disabled, but it has no way to 

Version-Release number of selected component (if applicable):
dnsmasq-2.86-5.fc35.x86_64

How reproducible:
always

Steps to Reproduce:
1. enable dnssec and trust anchor
2. start dnsmasq
3. use local dnsmasq as resolver
4. visit https://rootcanary.org/test.html

Actual results:
All GOST algorithms fail with SERVFAIL. If GOST is disabled explicitly, it should fail with 

Expected results:
Names like secure.d3a7n3.rootcanary.net should either be INSECURE or VALID, but current result is bogus.


Additional info:

Comment 1 Petr Menšík 2022-03-23 17:23:15 UTC

GOST support in Fedora or RHEL is unwanted. Possible fix would be explicitly disabling its support from dnsmasq.

Comment 2 Ben Cotton 2022-08-09 13:14:14 UTC

This bug appears to have been reported against 'rawhide' during the Fedora Linux 37 development cycle.
Changing version to 37.

Comment 3 Fedora Update System 2022-12-08 15:57:08 UTC

FEDORA-2022-28dc37634d has been submitted as an update to Fedora 37. https://bodhi.fedoraproject.org/updates/FEDORA-2022-28dc37634d

Comment 4 Petr Menšík 2022-12-08 16:06:04 UTC

Fixed by these upstream commits in release 2.88:
http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=02f87543399ca311651dc446a830f0e24d21061c
http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=9ed3ee67ecd2a388d319bff116b27bcc62286ccc
http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=1f9215f5f92c5478c8aaba8054d192a5e6280e95
http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=f52cfdd8c37e09d77abdc151a4ddcf94f49f4821

Already contained in release 2.88, which is already pushed in Rawhide branch.

Comment 5 Petr Menšík 2022-12-08 17:51:40 UTC

This have been fixed in new release 2.88 (bug #2150667). I think backport is not needed, because these failures were not reported by actual users.

Comment 6 Fedora Update System 2022-12-09 02:35:47 UTC

FEDORA-2022-28dc37634d has been pushed to the Fedora 37 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2022-28dc37634d`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2022-28dc37634d

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2023-01-03 01:24:30 UTC

FEDORA-2022-28dc37634d has been pushed to the Fedora 37 stable repository.
If problem still persists, please make note of it in this bug report.