| 2018-10-06 16:27:23 |
jrb0001 |
bug |
|
|
added bug |
| 2018-10-06 16:27:23 |
jrb0001 |
attachment added |
|
Commands including output https://bugs.launchpad.net/bugs/1796501/+attachment/5198077/+files/systemd-resolved-bug.commands |
|
| 2018-10-06 16:28:06 |
jrb0001 |
attachment added |
|
Filtered packet capture https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1796501/+attachment/5198078/+files/systemd-resolved-bug.pcapng |
|
| 2018-10-21 22:44:56 |
Bryan Quigley |
bug |
|
|
added subscriber Bryan Quigley |
| 2018-10-23 00:46:04 |
Bryan Quigley |
tags |
|
sts |
|
| 2018-10-23 00:48:45 |
Bryan Quigley |
bug watch added |
|
https://github.com/systemd/systemd/issues/6490 |
|
| 2018-10-23 17:49:23 |
Bryan Quigley |
bug |
|
|
added subscriber Dimitri John Ledkov |
| 2019-01-23 15:42:18 |
Launchpad Janitor |
systemd (Ubuntu): status |
New |
Confirmed |
|
| 2019-02-19 15:13:15 |
Eric Desrochers |
systemd (Ubuntu): assignee |
|
Dimitri John Ledkov (xnox) |
|
| 2019-02-19 15:13:20 |
Eric Desrochers |
systemd (Ubuntu): status |
Confirmed |
In Progress |
|
| 2019-02-19 15:13:23 |
Eric Desrochers |
systemd (Ubuntu): importance |
Undecided |
Medium |
|
| 2019-02-19 15:15:22 |
Eric Desrochers |
nominated for series |
|
Ubuntu Disco |
|
| 2019-02-19 15:15:22 |
Eric Desrochers |
bug task added |
|
systemd (Ubuntu Disco) |
|
| 2019-02-19 15:15:22 |
Eric Desrochers |
nominated for series |
|
Ubuntu Cosmic |
|
| 2019-02-19 15:15:22 |
Eric Desrochers |
bug task added |
|
systemd (Ubuntu Cosmic) |
|
| 2019-02-19 15:15:22 |
Eric Desrochers |
nominated for series |
|
Ubuntu Bionic |
|
| 2019-02-19 15:15:22 |
Eric Desrochers |
bug task added |
|
systemd (Ubuntu Bionic) |
|
| 2019-02-19 15:15:49 |
Eric Desrochers |
systemd (Ubuntu Cosmic): assignee |
|
Dimitri John Ledkov (xnox) |
|
| 2019-02-19 15:15:58 |
Eric Desrochers |
systemd (Ubuntu Bionic): assignee |
|
Dimitri John Ledkov (xnox) |
|
| 2019-02-19 15:16:03 |
Eric Desrochers |
systemd (Ubuntu Cosmic): status |
New |
In Progress |
|
| 2019-02-19 15:16:05 |
Eric Desrochers |
systemd (Ubuntu Bionic): status |
New |
In Progress |
|
| 2019-02-19 15:16:13 |
Eric Desrochers |
systemd (Ubuntu Cosmic): importance |
Undecided |
Medium |
|
| 2019-02-19 15:16:15 |
Eric Desrochers |
systemd (Ubuntu Bionic): importance |
Undecided |
Medium |
|
| 2019-02-19 15:19:29 |
Eric Desrochers |
bug watch added |
|
https://github.com/systemd/systemd/issues/9384 |
|
| 2019-02-19 15:57:25 |
Kai Kasurinen |
bug |
|
|
added subscriber Kai Kasurinen |
| 2019-03-04 22:33:10 |
Abam |
bug |
|
|
added subscriber Abam |
| 2019-04-08 14:22:46 |
Dan Streetman |
tags |
sts |
|
|
| 2019-05-31 20:18:33 |
Dan Streetman |
tags |
|
sts |
|
| 2019-07-18 20:28:52 |
Dan Streetman |
bug |
|
|
added subscriber Dan Streetman |
| 2019-08-14 01:07:05 |
Bryan Quigley |
systemd (Ubuntu Cosmic): status |
In Progress |
Won't Fix |
|
| 2019-09-12 23:20:36 |
Bryan Quigley |
attachment added |
|
eoan debdiff https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1796501/+attachment/5288416/+files/systemd_241-7ubuntu2.debdiff |
|
| 2019-09-13 00:23:16 |
Ubuntu Foundations Team Bug Bot |
tags |
sts |
patch sts |
|
| 2019-09-13 00:23:22 |
Ubuntu Foundations Team Bug Bot |
bug |
|
|
added subscriber Ubuntu Sponsors Team |
| 2019-09-20 09:41:23 |
Balint Reczey |
bug |
|
|
added subscriber Balint Reczey |
| 2019-10-01 12:28:05 |
Francis Ginther |
tags |
patch sts |
id-5d92536b4bcd9c68caddc01c patch sts |
|
| 2019-10-04 18:19:04 |
Victor Tapia |
attachment removed |
eoan debdiff https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1796501/+attachment/5288416/+files/systemd_241-7ubuntu2.debdiff |
|
|
| 2019-10-04 18:19:48 |
Victor Tapia |
attachment added |
|
eoan.debdiff https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1796501/+attachment/5294401/+files/eoan.debdiff |
|
| 2019-10-04 19:14:36 |
Victor Tapia |
attachment removed |
eoan.debdiff https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1796501/+attachment/5294401/+files/eoan.debdiff |
|
|
| 2019-10-04 19:15:17 |
Victor Tapia |
attachment added |
|
eoan.debdiff https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1796501/+attachment/5294438/+files/eoan.debdiff |
|
| 2019-10-04 19:52:31 |
Balint Reczey |
systemd (Ubuntu): assignee |
Dimitri John Ledkov (xnox) |
Balint Reczey (rbalint) |
|
| 2019-10-04 19:58:10 |
Eric Desrochers |
bug |
|
|
added subscriber STS Sponsors |
| 2019-10-04 19:58:19 |
Eric Desrochers |
tags |
id-5d92536b4bcd9c68caddc01c patch sts |
id-5d92536b4bcd9c68caddc01c patch sts sts-sponsor-ddstreet |
|
| 2019-10-04 20:03:48 |
Eric Desrochers |
removed subscriber STS Sponsors |
|
|
|
| 2019-10-07 21:00:55 |
Dan Streetman |
tags |
id-5d92536b4bcd9c68caddc01c patch sts sts-sponsor-ddstreet |
ddstreet id-5d92536b4bcd9c68caddc01c patch sts sts-sponsor-ddstreet systemd |
|
| 2019-10-07 21:01:08 |
Dan Streetman |
tags |
ddstreet id-5d92536b4bcd9c68caddc01c patch sts sts-sponsor-ddstreet systemd |
bionic ddstreet disco id-5d92536b4bcd9c68caddc01c patch sts sts-sponsor-ddstreet systemd |
|
| 2019-10-08 18:48:41 |
Dan Streetman |
removed subscriber Ubuntu Sponsors Team |
|
|
|
| 2019-10-10 21:21:30 |
Dan Streetman |
description |
I ask systemd-resolved through dig to resolve the SOA of test.asdf. (doesn't exist) but it returns SERVFAIL instead of NXDOMAIN. It seems to do the following steps:
1. Ask upstream for SOA of test.asdf. with EDNS0, DO-bit and 4k size.
2. Ask upstream for SOA of test.asdf. with EDNS0 and DO-bit.
3. Ask upstream for SOA of test.asdf. with EDNS0.
4. Ask upstream for SOA of test.asdf. without EDNS0.
5. Repeat 1-4 for DS of test.asdf.
6. Repeat 1-5 for asdf.
7. Ask upstream for SOA of . with EDNS0, DO-bit and 4k size.
8. Ask upstream for DNSKEY of . with EDNS0, DO-bit and 4k size.
The upstream returns an unfragmented NXDOMAIN response for steps 1-6, an unfragmented NOERROR response for step 7 and a fragmented NOERROR response for step 8 which is the correct behaviour. DNSSEC records are included in the response if the DO-bit in the request was set.
systemd-resolved should take the response from step 1 and start with validation instead of starting useless retries with reduced feture set. Step 3 and 4 are completely useless and probably lead to the SERVFAIL because I have configured it with DNSSEC=yes to prevent downgrade attacks.
This regression seems to be caused by the patch resolved-Mitigate-DVE-2018-0001-by-retrying-NXDOMAIN-with.patch. The downgrade logic should only be executed if it is configured as DNSSEC=allow-downgrade or DNSSEC=no. See also https://github.com/systemd/systemd/pull/8608#issuecomment-396927885. |
[impact]
an NXDOMAIN response from a dns server when systemd-resolved is configured as DNSSEC=yes breaks dns resolution as it downgrades from DNSSEC.
[test case]
see comment 9
[regression potential]
as with the original patch that introduced this problem, this has the potential to break dns resolution.
[other info]
original description:
I ask systemd-resolved through dig to resolve the SOA of test.asdf. (doesn't exist) but it returns SERVFAIL instead of NXDOMAIN. It seems to do the following steps:
1. Ask upstream for SOA of test.asdf. with EDNS0, DO-bit and 4k size.
2. Ask upstream for SOA of test.asdf. with EDNS0 and DO-bit.
3. Ask upstream for SOA of test.asdf. with EDNS0.
4. Ask upstream for SOA of test.asdf. without EDNS0.
5. Repeat 1-4 for DS of test.asdf.
6. Repeat 1-5 for asdf.
7. Ask upstream for SOA of . with EDNS0, DO-bit and 4k size.
8. Ask upstream for DNSKEY of . with EDNS0, DO-bit and 4k size.
The upstream returns an unfragmented NXDOMAIN response for steps 1-6, an unfragmented NOERROR response for step 7 and a fragmented NOERROR response for step 8 which is the correct behaviour. DNSSEC records are included in the response if the DO-bit in the request was set.
systemd-resolved should take the response from step 1 and start with validation instead of starting useless retries with reduced feture set. Step 3 and 4 are completely useless and probably lead to the SERVFAIL because I have configured it with DNSSEC=yes to prevent downgrade attacks.
This regression seems to be caused by the patch resolved-Mitigate-DVE-2018-0001-by-retrying-NXDOMAIN-with.patch. The downgrade logic should only be executed if it is configured as DNSSEC=allow-downgrade or DNSSEC=no. See also https://github.com/systemd/systemd/pull/8608#issuecomment-396927885. |
|
| 2019-10-10 23:29:50 |
Launchpad Janitor |
systemd (Ubuntu): status |
In Progress |
Fix Released |
|
| 2019-11-09 01:02:30 |
Steve Langasek |
systemd (Ubuntu Disco): status |
In Progress |
Fix Committed |
|
| 2019-11-09 01:02:32 |
Steve Langasek |
bug |
|
|
added subscriber Ubuntu Stable Release Updates Team |
| 2019-11-09 01:02:35 |
Steve Langasek |
bug |
|
|
added subscriber SRU Verification |
| 2019-11-09 01:02:40 |
Steve Langasek |
tags |
bionic ddstreet disco id-5d92536b4bcd9c68caddc01c patch sts sts-sponsor-ddstreet systemd |
bionic ddstreet disco id-5d92536b4bcd9c68caddc01c patch sts sts-sponsor-ddstreet systemd verification-needed verification-needed-disco |
|
| 2019-11-14 15:00:19 |
Łukasz Zemczak |
systemd (Ubuntu Bionic): status |
In Progress |
Fix Committed |
|
| 2019-11-14 15:00:26 |
Łukasz Zemczak |
tags |
bionic ddstreet disco id-5d92536b4bcd9c68caddc01c patch sts sts-sponsor-ddstreet systemd verification-needed verification-needed-disco |
bionic ddstreet disco id-5d92536b4bcd9c68caddc01c patch sts sts-sponsor-ddstreet systemd verification-needed verification-needed-bionic verification-needed-disco |
|
| 2019-11-14 19:09:00 |
Bryan Quigley |
tags |
bionic ddstreet disco id-5d92536b4bcd9c68caddc01c patch sts sts-sponsor-ddstreet systemd verification-needed verification-needed-bionic verification-needed-disco |
bionic ddstreet disco id-5d92536b4bcd9c68caddc01c patch sts sts-sponsor-ddstreet systemd verification-done-disco verification-needed verification-needed-bionic |
|
| 2019-11-14 21:50:35 |
Bryan Quigley |
tags |
bionic ddstreet disco id-5d92536b4bcd9c68caddc01c patch sts sts-sponsor-ddstreet systemd verification-done-disco verification-needed verification-needed-bionic |
bionic ddstreet disco id-5d92536b4bcd9c68caddc01c patch sts sts-sponsor-ddstreet systemd verification-done verification-done-bionic verification-done-disco |
|
| 2019-11-15 16:41:07 |
Steve Langasek |
tags |
bionic ddstreet disco id-5d92536b4bcd9c68caddc01c patch sts sts-sponsor-ddstreet systemd verification-done verification-done-bionic verification-done-disco |
bionic ddstreet disco id-5d92536b4bcd9c68caddc01c patch sts sts-sponsor-ddstreet systemd verification-done-disco verification-needed verification-needed-bionic |
|
| 2019-11-25 11:18:51 |
Launchpad Janitor |
systemd (Ubuntu Disco): status |
Fix Committed |
Fix Released |
|
| 2019-11-25 11:19:19 |
Łukasz Zemczak |
removed subscriber Ubuntu Stable Release Updates Team |
|
|
|
| 2019-11-25 13:13:34 |
Kai Kasurinen |
removed subscriber Kai Kasurinen |
|
|
|
| 2019-11-26 03:47:24 |
Dan Streetman |
tags |
bionic ddstreet disco id-5d92536b4bcd9c68caddc01c patch sts sts-sponsor-ddstreet systemd verification-done-disco verification-needed verification-needed-bionic |
bionic ddstreet disco id-5d92536b4bcd9c68caddc01c patch sts sts-sponsor-ddstreet systemd verification-done verification-done-bionic verification-done-disco |
|
| 2019-11-26 03:47:35 |
Dan Streetman |
tags |
bionic ddstreet disco id-5d92536b4bcd9c68caddc01c patch sts sts-sponsor-ddstreet systemd verification-done verification-done-bionic verification-done-disco |
bionic ddstreet disco id-5d92536b4bcd9c68caddc01c patch sts systemd verification-done verification-done-bionic verification-done-disco |
|
| 2019-11-26 17:37:57 |
Launchpad Janitor |
systemd (Ubuntu Bionic): status |
Fix Committed |
Fix Released |
|
