nss-resolve should return NOTFOUND rather than UNAVAIL on DNSSEC validation failure

[andersk]

Submission type

• Bug report
• Request for enhancement (RFE)

systemd version the issue has been seen with

231

Used distribution

Ubuntu 16.10

Ubuntu has configured nsswitch.conf as follows:

hosts: files resolve dns

in order to get a fallback from libnss_resolve.so to libnss_dns.so if the former is missing for the current architecture. Unfortunately, by doing so, they broke DNSSEC validation: a validation failure also triggers the fallback, and the query will be retried through libnss_dns.so when it should fail. They also made NXDOMAIN lookups twice as slow, for the same reason.

The NXDOMAIN problem is simple enough to fix:

hosts: files resolve [!UNAVAIL=return] dns

Unfortunately, this is insufficient to fix DNSSEC validation. On validation failures, libnss_resolve.so presently returns UNAVAIL, which glibc treats indistinguishably from libnss_resolve.so being missing.

The only way to fix this is for libnss_resolve.so to return NOTFOUND rather than UNAVAIL on validation failures. It needs to be impossible for an active network attacker to force libnss_resolve.so to return UNAVAIL (whether through an unsigned response, a totally bogus response, or no response at all).

[martinpitt]

Indeed, UNAVAIL applies to the NSS module, or (depending on your interpretation) to "the queried DNS server does not exist", but not to "the DNS name is invalid" (not existing or failed validation) -- that's clearly NOTFOUND. Thanks for spotting!