networkd-test.py fails with dnsmasq 2.80 in test_resolved_domain_restricted_dns #10487

mbiebl · 2018-10-22T15:42:49Z

systemd version the issue has been seen with

v239
git master

Used distribution

Debian sid

This is from the downstream bug report https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=911408

After the update of dnsmasq from 2.79 to 2.80, the systemd autopkgtest fails for test/networkd-test.py.

Running git bisect on dnsmasq identified the following commit as the problematic one:
http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=1682d15a744880b0398af75eadf68fe66128af78

commit 1682d15a744880b0398af75eadf68fe66128af78
Author: Simon Kelley <simon@thekelleys.org.uk>
Date:   Fri Aug 3 20:38:18 2018 +0100

    Add missing EDNS0 section.
    EDNS0 section missing in replies to EDNS0-containing queries where
    answer generated from --local=/<domain>/

Simon Kelley (the author of dnsmasq) replied at https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=911408#52

The failing test is

======================================================================
ERROR: test_resolved_domain_restricted_dns (__main__.DnsmasqClientTest)
resolved: domain-restricted DNS servers
----------------------------------------------------------------------
Traceback (most recent call last):
  File
"/tmp/autopkgtest-lxc.mecm2pp3/downtmp/build.egD/src/test/networkd-test.py",
line 583, in test_resolved_domain_restricted_dns
    out = subprocess.check_output(['systemd-resolve', 'math.lab'])
  File "/usr/lib/python3.6/subprocess.py", line 336, in check_output
    **kwargs).stdout
  File "/usr/lib/python3.6/subprocess.py", line 418, in run
    output=stdout, stderr=stderr)
subprocess.CalledProcessError: Command '['systemd-resolve', 'math.lab']'
returned non-zero exit status 1.

----------------------------------------------------------------------
Ran 36 tests in 208.186s

FAILED (errors=1, skipped=2)

I can't really answer the questions Simon raised in the Debian bug report, so I'm filing this bug report here to get further input.

The text was updated successfully, but these errors were encountered:

mbiebl · 2018-10-22T16:03:22Z

The problem should be easily reproducible via ./test/networkd-test.py DnsmasqClientTest.test_resolved_domain_restricted_dns

mbiebl · 2018-10-22T16:17:03Z

Fwiw, with 2.79 I get:

# resolvectl query kettle.cantina.company
kettle.cantina.company: 10.241.4.4

-- Information acquired via protocol DNS in 3.4ms.
-- Data is authenticated: no

With 2.80 I get

# resolvectl query kettle.cantina.company
kettle.cantina.company: resolve call failed: DNSSEC validation failed: no-signature

mbiebl · 2018-10-22T17:09:14Z

v2.80

# systemd-resolve math.lab
math.lab: 10.241.3.3

-- Information acquired via protocol DNS in 28.3ms.
-- Data is authenticated: no

Oct 22 17:07:51 debian systemd-resolved[7627]: Detected a negative query math.lab IN DS in a private DNS zone, permitting unsigned response.                                                                                            

# systemd-resolve kettle.cantina.company
kettle.cantina.company: resolve call failed: DNSSEC validation failed: no-signature

Oct 22 17:08:40 debian systemd-resolved[7627]: DNSSEC validation failed for question cantina.company IN DS: no-signature                                                                                                                
Oct 22 17:08:40 debian systemd-resolved[7627]: DNSSEC validation failed for question cantina.company IN SOA: no-signature                                                                                                               
Oct 22 17:08:40 debian systemd-resolved[7627]: DNSSEC validation failed for question kettle.cantina.company IN DS: no-signature                                                                                                         
Oct 22 17:08:40 debian systemd-resolved[7627]: DNSSEC validation failed for question kettle.cantina.company IN SOA: no-signature                                                                                                        
Oct 22 17:08:40 debian systemd-resolved[7627]: DNSSEC validation failed for question kettle.cantina.company IN A: no-signature

mbiebl · 2018-11-05T13:52:38Z

Simon Kelley, the dnsmasq author, claims this is an systemd-networkd issue.
@pfl any ideas?

pfl · 2018-11-05T17:18:50Z

@pfl any ideas?

Sorry, no ideas right now. I don't know enough of DNS to be able to help very quickly.

mbiebl · 2018-11-07T15:19:45Z

running networkd-test.py with dnsmasq v2.79

# ps aux | grep dnsmasq
nobody   11520  0.0  0.3  25260  3332 pts/1    S+   23:10   0:00 dnsmasq --keep-in-foreground --log-queries --log-facility=/tmp/tmp3_id7zsx/dnsmasq.log --conf-file=/dev/null --dhcp-leasefile=/tmp/tmp3_id7zsx/dnsmasq.leases --bind-interfaces --interface=router_eth42 --except-interface=lo --dhcp-range=192.168.5.10,192.168.5.200 --address=/#/192.168.42.1
nobody   11531  0.0  0.3  25260  3316 pts/1    S+   23:10   0:00 dnsmasq --keep-in-foreground --log-queries --log-facility=/tmp/tmp3_id7zsx/dnsmasq-vpn.log --conf-file=/dev/null --dhcp-leasefile=/dev/null --bind-interfaces --interface=testvpnrouter --except-interface=lo --address=/math.lab/10.241.3.3 --address=/cantina.company/10.241.4.4


# resolvectl query kettle.cantina.company                                                                         
kettle.cantina.company: 10.241.4.4

-- Information acquired via protocol DNS in 3.6ms.
-- Data is authenticated: no

# cat /tmp/tmp3_id7zsx/dnsmasq-vpn.log
Nov  6 23:10:39 dnsmasq[11531]: started, version 2.79 cachesize 150
Nov  6 23:10:39 dnsmasq[11531]: compile time options: IPv6 GNU-getopt DBus i18n IDN DHCP DHCPv6 no-Lua TFTP conntrack ipset auth DNSSEC loop-detect inotify
Nov  6 23:10:39 dnsmasq[11531]: reading /etc/resolv.conf
Nov  6 23:10:39 dnsmasq[11531]: using nameserver 10.0.2.3#53
Nov  6 23:10:39 dnsmasq[11531]: read /etc/hosts - 4 addresses
Nov  6 23:17:38 dnsmasq[11531]: query[A] kettle.cantina.company from 10.241.3.1
Nov  6 23:17:38 dnsmasq[11531]: config kettle.cantina.company is 10.241.4.4
Nov  6 23:17:38 dnsmasq[11531]: query[A] kettle.cantina.company from 10.241.3.1
Nov  6 23:17:38 dnsmasq[11531]: config kettle.cantina.company is 10.241.4.4

# journalctl -u systemd-resolved

Nov 06 23:17:38 debian systemd-resolved[11545]: Using degraded feature set (UDP) for DNS server 10.241.3.1.
Nov 06 23:17:38 debian systemd-resolved[11545]: Server 10.241.3.1 does not support DNSSEC, downgrading to non-DNSSEC mode.

running networkd-test.py with dnsmasq v2.80

# ps aux | grep dnsmasq
nobody   13324  0.0  0.3  25280  3344 pts/1    S+   23:29   0:00 dnsmasq --keep-in-foreground --log-queries --log-facility=/tmp/tmpf3unvou5/dnsmasq.log --conf-file=/dev/null --dhcp-leasefile=/tmp/tmpf3unvou5/dnsmasq.leases --bind-interfaces --interface=router_eth42 --except-interface=lo --dhcp-range=192.168.5.10,192.168.5.200 --address=/#/192.168.42.1
nobody   13333  0.0  0.3  25280  3328 pts/1    S+   23:29   0:00 dnsmasq --keep-in-foreground --log-queries --log-facility=/tmp/tmpf3unvou5/dnsmasq-vpn.log --conf-file=/dev/null --dhcp-leasefile=/dev/null --bind-interfaces --interface=testvpnrouter --except-interface=lo --address=/math.lab/10.241.3.3 --address=/cantina.company/10.241.4.4

# resolvectl query kettle.cantina.company
kettle.cantina.company: resolve call failed: DNSSEC validation failed: no-signature

# cat /tmp/tmpf3unvou5/dnsmasq-vpn.log
Nov  6 23:29:09 dnsmasq[13333]: started, version 2.80 cachesize 150
Nov  6 23:29:09 dnsmasq[13333]: compile time options: IPv6 GNU-getopt DBus i18n IDN DHCP DHCPv6 no-Lua TFTP conntrack ipset auth DNSSEC loop-detect inotify dumpfile
Nov  6 23:29:09 dnsmasq[13333]: reading /etc/resolv.conf
Nov  6 23:29:09 dnsmasq[13333]: using nameserver 10.0.2.3#53
Nov  6 23:29:09 dnsmasq[13333]: read /etc/hosts - 4 addresses
Nov  6 23:29:56 dnsmasq[13333]: query[A] kettle.cantina.company from 10.241.3.1
Nov  6 23:29:56 dnsmasq[13333]: config kettle.cantina.company is 10.241.4.4
Nov  6 23:29:56 dnsmasq[13333]: query[SOA] kettle.cantina.company from 10.241.3.1
Nov  6 23:29:56 dnsmasq[13333]: config kettle.cantina.company is NODATA
Nov  6 23:29:56 dnsmasq[13333]: query[DS] kettle.cantina.company from 10.241.3.1
Nov  6 23:29:56 dnsmasq[13333]: config kettle.cantina.company is NODATA
Nov  6 23:29:56 dnsmasq[13333]: query[SOA] cantina.company from 10.241.3.1
Nov  6 23:29:56 dnsmasq[13333]: config cantina.company is NODATA
Nov  6 23:29:56 dnsmasq[13333]: query[DS] cantina.company from 10.241.3.1
Nov  6 23:29:56 dnsmasq[13333]: config cantina.company is NODATA
Nov  6 23:29:56 dnsmasq[13333]: query[SOA] company from 10.241.3.1
Nov  6 23:29:56 dnsmasq[13333]: forwarded company to 10.0.2.3
Nov  6 23:29:56 dnsmasq[13333]: query[DNSKEY] company from 10.241.3.1
Nov  6 23:29:56 dnsmasq[13333]: forwarded company to 10.0.2.3
Nov  6 23:29:56 dnsmasq[13333]: query[DS] company from 10.241.3.1
Nov  6 23:29:56 dnsmasq[13333]: forwarded company to 10.0.2.3
Nov  6 23:29:56 dnsmasq[13333]: query[DNSKEY] . from 10.241.3.1
Nov  6 23:29:56 dnsmasq[13333]: forwarded . to 10.0.2.3

# journalctl -u systemd-resolved
Nov 06 23:29:56 debian systemd-resolved[13349]: DNSSEC validation failed for question cantina.company IN DS: no-signature
Nov 06 23:29:56 debian systemd-resolved[13349]: DNSSEC validation failed for question cantina.company IN SOA: no-signature
Nov 06 23:29:56 debian systemd-resolved[13349]: DNSSEC validation failed for question kettle.cantina.company IN DS: no-signature
Nov 06 23:29:56 debian systemd-resolved[13349]: DNSSEC validation failed for question kettle.cantina.company IN SOA: no-signature
Nov 06 23:29:56 debian systemd-resolved[13349]: DNSSEC validation failed for question kettle.cantina.company IN A: no-signature

mbiebl · 2018-11-15T12:22:58Z

dnsmasq 2.80 has been released on 18 October 2018. That means this issue will hit other distros sooner or later as well (probably sooner). I'd thus like to bump the visibility of this issue by adding it to the v240 milestone.

mbiebl · 2018-12-01T12:55:10Z

Another friendly ping.
Anyone around who is familiar with dnsmasq and networkd and can have a look at that?

poettering · 2018-12-05T20:06:40Z

let's drop this from the milestone. it's difficult to test this when this isn't packaged yet on fedora. I mean, by all means, this is worth fixing, but I am not convinced we need to delay the release for that.

mbiebl · 2018-12-05T20:20:12Z

I was under the impression, Rawhide does ship 2.80.
http://mirror.23media.de/fedora/linux/development/rawhide/Everything/x86_64/os/Packages/d/
https://src.fedoraproject.org/rpms/dnsmasq/c/d63c7d423ae5eb8c3b12741e8a3afef4f7d889df?branch=master

poettering · 2018-12-05T20:56:12Z

yeah, but i don't run rawhide...

poettering · 2019-03-26T17:12:37Z

Hmm, still not in f29, let's bump this.

We need to list the synthesized domains as NTAs, otherwise the DNSSEC validation of course cannot succeed. Fixes: systemd#10487 systemd#5029

We need to list the synthesized domains as NTAs, otherwise the DNSSEC validation of course cannot succeed. Fixes: #10487 #5029

bluca · 2023-05-05T19:55:14Z

I've been seeing this same issue occasionally in jammy for a few weeks now:

ERROR: test_resolved_domain_restricted_dns (__main__.DnsmasqClientTest)
resolved: domain-restricted DNS servers
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/tmp/autopkgtest.OTtxkk/build.NOz/systemd/test/networkd-test.py", line 680, in test_resolved_domain_restricted_dns
    out = subprocess.check_output(['resolvectl', 'query', 'math.lab'])
  File "/usr/lib/python3.10/subprocess.py", line 420, in check_output
    return run(*popenargs, stdout=PIPE, timeout=timeout, check=True,
  File "/usr/lib/python3.10/subprocess.py", line 524, in run
    raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command '['resolvectl', 'query', 'math.lab']' returned non-zero exit status 1.

@yuwata @mrc0mmand any idea?

mbiebl · 2024-03-01T22:53:47Z

Let's close this as well. I don't have a setup from 2018 anymore to test the changes from #31557

mbiebl added resolve tests labels Oct 22, 2018

mbiebl added this to the v240 milestone Nov 15, 2018

poettering modified the milestones: v240, v241 Dec 5, 2018

mbiebl modified the milestones: v241, v242 Jan 11, 2019

mbiebl mentioned this issue Feb 27, 2019

Various networkd test fixes #11784

Merged

poettering modified the milestones: v242, v243 Mar 26, 2019

poettering modified the milestones: v243, v244 Jul 13, 2019

poettering modified the milestones: v244, v245 Nov 15, 2019

poettering modified the milestones: v245, v246 Jan 14, 2020

poettering modified the milestones: v246, v247 Apr 23, 2020

poettering modified the milestones: v247, v248 Sep 17, 2020

poettering added a commit to poettering/systemd that referenced this issue Nov 18, 2020

networkd-test: reenable dnssec while testing

0bc9ec3

We need to list the synthesized domains as NTAs, otherwise the DNSSEC validation of course cannot succeed. Fixes: systemd#10487 systemd#5029

poettering mentioned this issue Nov 18, 2020

resolved: support for dnssec requests in the stub & a lot of other stuff #17535

Closed

poettering added a commit to poettering/systemd that referenced this issue Nov 18, 2020

networkd-test: reenable dnssec while testing

9343332

We need to list the synthesized domains as NTAs, otherwise the DNSSEC validation of course cannot succeed. Fixes: systemd#10487 systemd#5029

poettering added a commit to poettering/systemd that referenced this issue Nov 18, 2020

networkd-test: reenable dnssec while testing

4ce2f52

We need to list the synthesized domains as NTAs, otherwise the DNSSEC validation of course cannot succeed. Fixes: systemd#10487 systemd#5029

poettering added a commit to poettering/systemd that referenced this issue Nov 19, 2020

networkd-test: reenable dnssec while testing

2348ad9

We need to list the synthesized domains as NTAs, otherwise the DNSSEC validation of course cannot succeed. Fixes: systemd#10487 systemd#5029

poettering added a commit to poettering/systemd that referenced this issue Nov 20, 2020

networkd-test: reenable dnssec while testing

e4bfa5a

We need to list the synthesized domains as NTAs, otherwise the DNSSEC validation of course cannot succeed. Fixes: systemd#10487 systemd#5029

poettering added a commit to poettering/systemd that referenced this issue Dec 2, 2020

networkd-test: reenable dnssec while testing

7b70b1a

We need to list the synthesized domains as NTAs, otherwise the DNSSEC validation of course cannot succeed. Fixes: systemd#10487 systemd#5029

poettering added a commit to poettering/systemd that referenced this issue Dec 3, 2020

networkd-test: reenable dnssec while testing

8621c88

We need to list the synthesized domains as NTAs, otherwise the DNSSEC validation of course cannot succeed. Fixes: systemd#10487 systemd#5029

poettering added a commit to poettering/systemd that referenced this issue Dec 4, 2020

networkd-test: reenable dnssec while testing

bf47346

We need to list the synthesized domains as NTAs, otherwise the DNSSEC validation of course cannot succeed. Fixes: systemd#10487 systemd#5029

poettering added a commit to poettering/systemd that referenced this issue Dec 7, 2020

networkd-test: reenable dnssec while testing

7660abd

We need to list the synthesized domains as NTAs, otherwise the DNSSEC validation of course cannot succeed. Fixes: systemd#10487 systemd#5029

poettering added a commit to poettering/systemd that referenced this issue Feb 17, 2021

networkd-test: reenable dnssec while testing

c0c41ab

We need to list the synthesized domains as NTAs, otherwise the DNSSEC validation of course cannot succeed. Fixes: systemd#10487 systemd#5029

poettering mentioned this issue Feb 17, 2021

networkd-test: reenable dnssec while testing #18666

Merged

bluca closed this as completed in #18666 Feb 18, 2021

bluca pushed a commit that referenced this issue Feb 18, 2021

networkd-test: reenable dnssec while testing

489344f

We need to list the synthesized domains as NTAs, otherwise the DNSSEC validation of course cannot succeed. Fixes: #10487 #5029

bluca reopened this May 5, 2023

mbiebl mentioned this issue Feb 28, 2024

autopkgtest failure of networkd-test.py: ERROR: test_resolved_domain_restricted_dns (__main__.DnsmasqClientTest.test_resolved_domain_restricted_dns) #31528

Closed

rpigott mentioned this issue Mar 1, 2024

resolve: skip IP_UNICAST_IF for local sockets #31557

Merged

mbiebl closed this as completed Mar 1, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

networkd-test.py fails with dnsmasq 2.80 in test_resolved_domain_restricted_dns #10487

networkd-test.py fails with dnsmasq 2.80 in test_resolved_domain_restricted_dns #10487

mbiebl commented Oct 22, 2018

mbiebl commented Oct 22, 2018

mbiebl commented Oct 22, 2018

mbiebl commented Oct 22, 2018

mbiebl commented Nov 5, 2018

pfl commented Nov 5, 2018

mbiebl commented Nov 7, 2018 •

edited

Loading

mbiebl commented Nov 15, 2018

mbiebl commented Dec 1, 2018

poettering commented Dec 5, 2018

mbiebl commented Dec 5, 2018

poettering commented Dec 5, 2018

poettering commented Mar 26, 2019

bluca commented May 5, 2023

mbiebl commented Mar 1, 2024

networkd-test.py fails with dnsmasq 2.80 in test_resolved_domain_restricted_dns #10487

networkd-test.py fails with dnsmasq 2.80 in test_resolved_domain_restricted_dns #10487

Comments

mbiebl commented Oct 22, 2018

mbiebl commented Oct 22, 2018

mbiebl commented Oct 22, 2018

mbiebl commented Oct 22, 2018

mbiebl commented Nov 5, 2018

pfl commented Nov 5, 2018

mbiebl commented Nov 7, 2018 • edited Loading

mbiebl commented Nov 15, 2018

mbiebl commented Dec 1, 2018

poettering commented Dec 5, 2018

mbiebl commented Dec 5, 2018

poettering commented Dec 5, 2018

poettering commented Mar 26, 2019

bluca commented May 5, 2023

mbiebl commented Mar 1, 2024

mbiebl commented Nov 7, 2018 •

edited

Loading