Bug 2222260

Summary:	systemd-resolved: Unsigned name response in signed zone is not refused when DNSSEC=yes [fedora]
Product:	[Fedora] Fedora	Reporter:	Petr Menšík <pemensik>
Component:	systemd	Assignee:	systemd-maint
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	39	CC:	dtardon, fedoraproject, filbranden, lnykryn, msekleta, ryncsn, systemd-maint, yaneti, yuwatana, zbyszek
Target Milestone:	---	Keywords:	Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Linux
URL:	https://github.com/systemd/systemd/issues/25676
Whiteboard:
Fixed In Version:	systemd-254.8-2.fc39 systemd-253.15-2.fc38	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	2222261 (view as bug list)		Environment:
Last Closed:	2024-01-24 01:29:24 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2222672
Bug Blocks:	2222261, 2222266

Description Petr Menšík 2023-07-12 13:03:26 UTC

Found that on upstream issue:
https://github.com/systemd/systemd/issues/25676

All needed is to fake content in signed zone, reported with unbound:

server:
  local-zone: example.org typetransparent
  local-data: "example.org. 3600 IN A 127.0.0.1"



Reproducible: Always

Steps to Reproduce:
1. Enable DNSSEC=yes
2. Run local unbound, configure fake local-data
3. Set DNS=127.0.0.1
4. resolvectl query -t example.org
Actual Results:  
[root@rawhide ~]# resolvectl query -t a example.org
example.org IN A 127.0.0.1

-- Information acquired via protocol DNS in 8.5ms.
-- Data is authenticated: no; Data was acquired via local or encrypted transport: no
-- Data from: network
[root@rawhide ~]# resolvectl query -t aaaa example.org
example.org IN AAAA 2606:2800:220:1:248:1893:25c8:1946

-- Information acquired via protocol DNS in 10.2ms.
-- Data is authenticated: yes; Data was acquired via local or encrypted transport: no
-- Data from: network

Expected Results:  
Similar to when signature is present, -t a should be reported as invalid, only -t aaaa successful.

Marking it with high severity, because it undermines purpose of whole DNSSEC presence.

Comment 1 Fedora Release Engineering 2023-08-16 08:07:56 UTC

This bug appears to have been reported against 'rawhide' during the Fedora Linux 39 development cycle.
Changing version to 39.

Comment 2 Fedora Update System 2024-01-22 18:47:35 UTC

FEDORA-2024-c79658eedf has been submitted as an update to Fedora 38. https://bodhi.fedoraproject.org/updates/FEDORA-2024-c79658eedf

Comment 3 Fedora Update System 2024-01-22 18:48:14 UTC

FEDORA-2024-b8312ca5b3 has been submitted as an update to Fedora 39. https://bodhi.fedoraproject.org/updates/FEDORA-2024-b8312ca5b3

Comment 4 Fedora Update System 2024-01-23 01:18:06 UTC

FEDORA-2024-b8312ca5b3 has been pushed to the Fedora 39 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-b8312ca5b3`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-b8312ca5b3

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2024-01-23 01:51:51 UTC

FEDORA-2024-c79658eedf has been pushed to the Fedora 38 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-c79658eedf`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-c79658eedf

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2024-01-24 01:29:24 UTC

FEDORA-2024-b8312ca5b3 has been pushed to the Fedora 39 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 7 Fedora Update System 2024-01-27 02:12:34 UTC

FEDORA-2024-c79658eedf has been pushed to the Fedora 38 stable repository.
If problem still persists, please make note of it in this bug report.