16 Říj
2021
16 Říj
'21
17:50
Whilst setting up Knot Resolver (version 5.4.1 on Rocky 8), it fails to
resolve 213-133-203-34.newtel.in-addr.itconsult.net with a cold cache, but
succeeds if the cache has been specifically warmed. With the cold cache
SERVFAIL is returned and it logs:-
Oct 16 18:40:52 dt05 kresd[36140]: [dnssec] validation
failure: 213-133-203-34.newtel.in-addr.itconsult.net. PTR
The zone cut is between itconsult.net & newtel.in-addr.itconsult.net.
Also whilst itconsult.net is DNSSEC signed, newtel.in-addr.itconsult.net is
not. Thus, in-addr.itconsult.net is an empty non-terminal.
If one asks for NS for newtel.in-addr.itconsult.net, thereafter resolution
of the PTR then succeeds:-
[root@dt05 ~]# dig @dt05 -p 533 -t ptr
213-133-203-34.newtel.in-addr.itconsult.net
; <<>> DiG 9.11.26-RedHat-9.11.26-4.el8_4 <<>> @dt05 -p 533 -t ptr
213-133-203-34.newtel.in-addr.itconsult.net
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 39692
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;213-133-203-34.newtel.in-addr.itconsult.net. IN PTR
;; Query time: 6 msec
;; SERVER: 193.201.42.59#533(193.201.42.59)
;; WHEN: Sat Oct 16 18:40:52 BST 2021
;; MSG SIZE rcvd: 72
[root@dt05 ~]# dig @dt05 -p 533 -t ns newtel.in-addr.itconsult.net
; <<>> DiG 9.11.26-RedHat-9.11.26-4.el8_4 <<>> @dt05 -p 533 -t ns
newtel.in-addr.itconsult.net
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2636
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;newtel.in-addr.itconsult.net. IN NS
;; ANSWER SECTION:
newtel.in-addr.itconsult.net. 86400 IN NS c.itconsult-dns.je.
newtel.in-addr.itconsult.net. 86400 IN NS d.itconsult-dns.co.uk.
newtel.in-addr.itconsult.net. 86400 IN NS e.itconsult-dns.biz.
newtel.in-addr.itconsult.net. 86400 IN NS a.itconsult-dns.net.
newtel.in-addr.itconsult.net. 86400 IN NS b.itconsult-dns.org.
;; Query time: 2 msec
;; SERVER: 193.201.42.59#533(193.201.42.59)
;; WHEN: Sat Oct 16 18:41:05 BST 2021
;; MSG SIZE rcvd: 223
[root@dt05 ~]# dig @dt05 -p 533 -t ptr 213-133-203-34.newtel.in-addr.itconsult.net
; <<>> DiG 9.11.26-RedHat-9.11.26-4.el8_4 <<>> @dt05 -p 533 -t ptr
213-133-203-34.newtel.in-addr.itconsult.net
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8992
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;213-133-203-34.newtel.in-addr.itconsult.net. IN PTR
;; ANSWER SECTION:
213-133-203-34.newtel.in-addr.itconsult.net. 43200 IN PTR eth0-70.qr-r01a.itconsult.net.
;; Query time: 1 msec
;; SERVER: 193.201.42.59#533(193.201.42.59)
;; WHEN: Sat Oct 16 18:41:08 BST 2021
;; MSG SIZE rcvd: 102
My suspicion (being new to Knot Resolver) is that this somehow relates to
QNAME minimisation.
DNSviz is not reporting any problems:-
Is this a bug, or expected behaviour with a slightly odd setup?
Best wishes,
Matthew
18 Říj
18 Říj
9:56
On 16/10/2021 19.50, Matthew Richardson wrote:
Whilst setting up Knot Resolver (version 5.4.1 on
Rocky 8), it fails to
resolve 213-133-203-34.newtel.in-addr.itconsult.net with a cold cache, but
succeeds if the cache has been specifically warmed. With the cold cache
SERVFAIL is returned and it logs:-
> Oct 16 18:40:52 dt05 kresd[36140]: [dnssec] validation failure:
213-133-203-34.newtel.in-addr.itconsult.net. PTR
Hi,
I can't reproduce this behaviour. I get NOERROR even with cold cache.
What does your configuration look like? Is the issue reproducible in
your environment?
--
Tomas Krizek
PGP: 4A8B A48C 2AED 933B D495 C509 A1FB A5F7 EF8C 4869
10:13
Dear Tomas,
On 18/10/21 11:56, Tomas Krizek wrote:
On 16/10/2021 19.50, Matthew Richardson wrote:
Yes, I can reproduce the issue every time with this procedure:-
Whilst setting up Knot Resolver (version 5.4.1 on
Rocky 8), it fails to
resolve 213-133-203-34.newtel.in-addr.itconsult.net with a cold cache, but
succeeds if the cache has been specifically warmed. With the cold cache
SERVFAIL is returned and it logs:-
> Oct 16 18:40:52 dt05 kresd[36140]: [dnssec] validation failure:
213-133-203-34.newtel.in-addr.itconsult.net. PTR
Hi,
I can't reproduce this behaviour. I get NOERROR even with cold cache.
What does your configuration look like? Is the issue reproducible in
your environment? [root@dt05 ~]# systemctl stop kresd(a)1.service
[root@dt05 ~]# systemctl stop kres-cache-gc
[root@dt05 ~]# rm /var/cache/knot-resolver/*.mdb
rm: remove regular file '/var/cache/knot-resolver/data.mdb'? y
rm: remove regular file '/var/cache/knot-resolver/lock.mdb'? y
[root@dt05 ~]# systemctl start kresd(a)1.service
[root@dt05 ~]# dig @dt05 -p 533 -t ptr 213-133-203-34.newtel.in-addr.itconsult.net
; <<>> DiG 9.11.26-RedHat-9.11.26-4.el8_4 <<>> @dt05 -p 533 -t ptr
213-133-203-34.newtel.in-addr.itconsult.net
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 35112
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;213-133-203-34.newtel.in-addr.itconsult.net. IN PTR
;; Query time: 23 msec
;; SERVER: 193.201.42.59#533(193.201.42.59)
;; WHEN: Mon Oct 18 11:08:10 BST 2021
;; MSG SIZE rcvd: 72
The config is:-
[root@dt05 ~]# cat /etc/knot-resolver/kresd.conf
-- SPDX-License-Identifier: CC0-1.0
-- vim:syntax=lua:set ts=4 sw=4:
-- Refer to manual: https://knot-resolver.readthedocs.org/en/stable/
-- Network interface configuration
net.listen('127.0.0.1', 533, { kind = 'dns' })
net.listen('193.201.42.59', 533, { kind = 'dns' })
--net.listen('127.0.0.1', 853, { kind = 'tls' })
--net.listen('127.0.0.1', 443, { kind = 'doh2' })
--net.listen('::1', 53, { kind = 'dns', freebind = true })
--net.listen('::1', 853, { kind = 'tls', freebind = true })
--net.listen('::1', 443, { kind = 'doh2' })
-- Load useful modules
modules = {
'hints > iterate', -- Load /etc/hosts and allow custom root hints
'stats', -- Track internal statistics
'predict', -- Prefetch expiring/frequent records
'bogus_log',
}
-- Cache size
cache.size = 100 * MB
Hope this helps...
Best wishes,
Matthew
19 Říj
19 Říj
10:49
Dear Tomas,
On 18/10/21 11:56, Tomas Krizek wrote:
Having seen the post about 5.4.2-1.el8 being available from epel-testing, I
tried upgrading to it. The results remain a reproducible SERVFAIL using
the same procedure.
Best wishes,
Matthew
On 16/10/2021 19.50, Matthew Richardson wrote:
Yes, I can reproduce the issue every time with this procedure:- Whilst setting up Knot Resolver (version 5.4.1 on
Rocky 8), it fails to
resolve 213-133-203-34.newtel.in-addr.itconsult.net with a cold cache, but
succeeds if the cache has been specifically warmed. With the cold cache
SERVFAIL is returned and it logs:-
> Oct 16 18:40:52 dt05 kresd[36140]: [dnssec] validation failure:
213-133-203-34.newtel.in-addr.itconsult.net. PTR
Hi,
I can't reproduce this behaviour. I get NOERROR even with cold cache.
What does your configuration look like? Is the issue reproducible in
your environment?
15:30
On 19/10/2021 12.49, Matthew Richardson wrote:
Thanks for your detailed report and instructions. I've reproduced the
issue and it does seem like a DNSSEC validation bug in Knot Resolver.
Since it's reproducible, we should hopefully be able to fix that soon.
I've created an issue to track the bug.
https://gitlab.nic.cz/knot/knot-resolver/-/issues/679
--
Tomas Krizek
PGP: 4A8B A48C 2AED 933B D495 C509 A1FB A5F7 EF8C 4869
Dear Tomas,
On 18/10/21 11:56, Tomas Krizek wrote:
Having seen the post about 5.4.2-1.el8 being available from epel-testing, I
tried upgrading to it. The results remain a reproducible SERVFAIL using
the same procedure.
On 16/10/2021 19.50, Matthew Richardson wrote:
Yes, I can reproduce the issue every time with this procedure:-
Whilst setting up Knot Resolver (version 5.4.1 on
Rocky 8), it fails to
resolve 213-133-203-34.newtel.in-addr.itconsult.net with a cold cache, but
succeeds if the cache has been specifically warmed. With the cold cache
SERVFAIL is returned and it logs:-
> Oct 16 18:40:52 dt05 kresd[36140]: [dnssec] validation failure:
213-133-203-34.newtel.in-addr.itconsult.net. PTR
Hi,
I can't reproduce this behaviour. I get NOERROR even with cold cache.
What does your configuration look like? Is the issue reproducible in
your environment?
1298
days inactive
1301
days old
knot-resolver-users@lists.nic.cz
4 comments
2 participants
participants (2)
-
Matthew Richardson -
Tomas Krizek