Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

nss-resolve: return NOTFOUND instead of UNAVAIL for DNSSEC validation failures #4164

Merged
merged 3 commits into from
Oct 1, 2016
Merged

nss-resolve: return NOTFOUND instead of UNAVAIL for DNSSEC validation failures #4164

merged 3 commits into from
Oct 1, 2016

Conversation

martinpitt
Copy link
Contributor

@martinpitt martinpitt commented Sep 16, 2016 •
edited
Loading

It needs to be possible to tell apart "the nss-resolve module does not exist" (which can happen when running foreign-architecture programs) from "the queried DNS name failed DNSSEC validation". The latter is much more like "host not found" (NXDOMAIN), so return NOTFOUND for these cases too.

This makes it possible to configure a fallback to "dns" without breaking DNSSEC, with

`resolve [!UNAVAIL=return] dns`

Fixes #4157

@andersk
Copy link

andersk commented Sep 16, 2016

Hmm, my intuition is that the list of affected errors may be a lot larger than just NXDOMAIN, DNSSEC_FAILED, NO_TRUST_ANCHOR. Can a network attacker force TIMEOUT by dropping reply packets? Or INVALID_REPLY by forging a corrupted reply? Or RR_TYPE_UNSUPPORTED by forging a corresponding error reply? etc. Any condition that could be elicited by an attacker must not result in a fallback, and there seem to be a lot of those.

@martinpitt
Copy link
Contributor Author

We could also flip this around to whitelist errors for UNAVAIL, such as "resolved is not running" or similar D-Bus connection problems.

@martinpitt
Copy link
Contributor Author

Indeed that was a bit dense.. If we only use UNAVAIL for "libnss-resolve is not installed" (..for this architecture), then libnss-resolve itself must not return UNAVAIL by itself. That actually makes the whole thing simpler.

@martinpitt martinpitt added the reviewed/needs-rework 🔨 PR has been reviewed and needs another round of reworks label Sep 16, 2016
@martinpitt martinpitt removed the reviewed/needs-rework 🔨 PR has been reviewed and needs another round of reworks label Sep 16, 2016
@martinpitt
Copy link
Contributor Author

Updated, this is more robust now.

@martinpitt
Copy link
Contributor Author

Note that this does not affect the callers of gethostbyname() -- they only get to look at the errno that we set (and these are by and large fine). The return code is only being used for the (optional) [ACTION]s that you can put into nsswitch.conf.

Right now these are pretty useless, as we e. g. return NOTFOUND in the case where we do find a responsible name server which doesn't find a particular host (getent ahostsv4 foo.google.de), but we return UNAVAIL if there is no DNS zone (getent ahostsv4 foo.google.dex). This is not a distinction that you care about for actions in nsswitch.conf IMHO.

@martinpitt
Copy link
Contributor Author

I. e. the error codes with this are more predictable now:

  • NOTFOUND == "I am able to make a decision, and it is no"
  • UNAVAIL == "I cannot make a decision because my module doesn't exist"
  • TRYAGAIN == "I cannot make a decision because of a transient error".

@martinpitt
nss-resolve: simplify error handling
46c7a7a 
Handle general errors from the resolved call in _nss_resolve_gethostbyaddr2_r()
the same say as in the other variants: Just "goto fail" as that does exactly
the same.
@martinpitt
man: drop myhostname from recommended nsswitch host configuration
4484e17 
resolve includes myhostname functionality, so there is no need to add it again.
keszybz
keszybz reviewed Oct 1, 2016
View reviewed changes
man/nss-resolve.xml
@@ -95,6 +95,12 @@ rpc: db files

netgroup: nis</programlisting>

<para>If the <command>dns</command> module needs to be kept for cases where <command>nss-resolve</command> is not
available (like running foreign-architecture programs), configure <literal>hosts</literal> in
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

foreign arch is a bit special, why not say that "the module is not installed, or not available for current architecture"?

@martinpitt
nss-resolve: return NOTFOUND instead of UNAVAIL on resolution errors
d724751 
It needs to be possible to tell apart "the nss-resolve module does not exist"
(which can happen when running foreign-architecture programs) from "the queried
DNS name failed DNSSEC validation" or other errors. So return NOTFOUND for these
cases too, and only keep UNAVAIL for the cases where we cannot handle the given
address family.

This makes it possible to configure a fallback to "dns" without breaking
DNSSEC, with "resolve [!UNAVAIL=return] dns". Add this to the manpage.

This does not change behaviour if resolved is not running, as that already
falls back to the "dns" glibc module.

Fixes systemd#4157
@martinpitt
Copy link
Contributor Author

Updated again to clarify manpage and rebase on current master.

@keszybz keszybz merged commit e7866f2 into systemd:master Oct 1, 2016
@martinpitt martinpitt deleted the nss-resolve branch October 1, 2016 15:44
poettering added a commit to poettering/systemd that referenced this pull request Oct 24, 2016
@poettering
resolved: properly check for the root domain
413b05c 
Fix-up for systemd#4164
@poettering poettering mentioned this pull request Oct 24, 2016
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@keszybz keszybz keszybz left review comments

Assignees
No one assigned
Labels
documentation resolve
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

nss-resolve should return NOTFOUND rather than UNAVAIL on DNSSEC validation failure
3 participants
@martinpitt @andersk @keszybz