Description of problem: When dnssec validation is enabled and trust anchor filled, dnsmasq does not pass all algorithms on rootcanary.org/test. Digest 3(gosthash94) fails with SERVFAIL instead of INSECURE. Nettle on Fedora/RHEL has GOST implementation disabled, but it has no way to Version-Release number of selected component (if applicable): dnsmasq-2.86-5.fc35.x86_64 How reproducible: always Steps to Reproduce: 1. enable dnssec and trust anchor 2. start dnsmasq 3. use local dnsmasq as resolver 4. visit https://rootcanary.org/test.html Actual results: All GOST algorithms fail with SERVFAIL. If GOST is disabled explicitly, it should fail with Expected results: Names like secure.d3a7n3.rootcanary.net should either be INSECURE or VALID, but current result is bogus. Additional info:
GOST support in Fedora or RHEL is unwanted. Possible fix would be explicitly disabling its support from dnsmasq.
This bug appears to have been reported against 'rawhide' during the Fedora Linux 37 development cycle. Changing version to 37.
FEDORA-2022-28dc37634d has been submitted as an update to Fedora 37. https://bodhi.fedoraproject.org/updates/FEDORA-2022-28dc37634d
Fixed by these upstream commits in release 2.88: http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=02f87543399ca311651dc446a830f0e24d21061c http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=9ed3ee67ecd2a388d319bff116b27bcc62286ccc http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=1f9215f5f92c5478c8aaba8054d192a5e6280e95 http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=f52cfdd8c37e09d77abdc151a4ddcf94f49f4821 Already contained in release 2.88, which is already pushed in Rawhide branch.
This have been fixed in new release 2.88 (bug #2150667). I think backport is not needed, because these failures were not reported by actual users.
FEDORA-2022-28dc37634d has been pushed to the Fedora 37 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2022-28dc37634d` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2022-28dc37634d See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2022-28dc37634d has been pushed to the Fedora 37 stable repository. If problem still persists, please make note of it in this bug report.