systemd-resolved includes response in SERVFAIL answer in case of dnssec bogus #24827
Description
systemd version the issue has been seen with
251.4
Used distribution
Fedora 37
Linux kernel version used
No response
CPU architectures issue was seen on
x86_64
Component
systemd-resolved
Expected behaviour you didn't see
My upstream VM dnsmasq:
; <<>> DiG 9.18.5 <<>> dnssec-failed.org @192.168.122.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 46881
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; EDE: 6 (DNSSEC Bogus)
;; QUESTION SECTION:
;dnssec-failed.org. IN A
;; Query time: 0 msec
;; SERVER: 192.168.122.1#53(192.168.122.1) (UDP)
;; WHEN: Mon Sep 26 17:41:02 EDT 2022
;; MSG SIZE rcvd: 52
Unexpected behaviour you saw
- systemd-resolved creates hybrid response with answer AND status: SERVFAIL at the same time
; <<>> DiG 9.18.5 <<>> dnssec-failed.org @127.0.0.53
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 3675
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;dnssec-failed.org. IN A
;; ANSWER SECTION:
dnssec-failed.org. 281 IN A 96.99.227.255
;; Query time: 2 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Mon Sep 26 17:36:11 EDT 2022
;; MSG SIZE rcvd: 62
- I think it violates https://www.rfc-editor.org/rfc/rfc4035.html#section-5.5
- Also https://www.rfc-editor.org/rfc/rfc4035.html#section-4.7
Steps to reproduce the problem
- Enabled
DNSSEC=yesin resolved.conf - systemctl restart systemd-resolved
- dig @127.0.0.53 dnssec-failed.org
I think
Additional program output to the terminal or log subsystem illustrating the issue
No response