Re: Answers for www.dnssec-failed.org with dnssec-validation auto;

Ondřej Surý Wed, 17 Apr 2024 10:22:39 -0700

Let me guess - you are running on RHEL (without SHA-1 support) and dnssec-failed.org is signed with RSA/SHA-1…

Ondřej Surý — ISC (He/Him)

My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours.

On 17. 4. 2024, at 19:02, John Thurston <john.thurs...@alaska.gov> wrote:

A fresh day, and a fresh idea - I just spun up a completely new instance of named, listening on its own port, with a stripped down config. Now the behavior is even stranger.

I can see the "no valid signature found" line in the server log, but my 'dig' still gets an answer. What I can see in the logs tells me that named has determined the answer is invalid, but then it proceeds to deliver that answer to my client. I can't figure out why.

I feel like I am too far down into the weeds, and there is something basic I'm overlooking. Can anyone help re-orient me?

The .conf is pretty small, and looks like:

controls {
        inet 127.0.0.1 port 1953 allow {
                127.0.0.1/32;
        } keys {
                "ns88-testPrimary-key";
        };
};
options {
        directory "/var/opt/testPrimary/named/data";
        dump-file "cache_dump.db";
        listen-on port 1053 {
                127.0.0.1/32;
        };
        querylog yes;
        dnssec-validation auto;
        empty-zones-enable no;
        recursion yes;
};
key "ns88-testPrimary-key" {
        algorithm "hmac-sha256";
        secret "????????????????????????????????????????????";
};

When I launch it in the foreground, the output looks like:

17-Apr-2024 08:17:46.934 starting BIND 9.18.24 (Extended Support Version) <id:6d7674f>
17-Apr-2024 08:17:46.934 running on Linux x86_64 5.14.0-362.18.1.el9_3.x86_64 #1 SMP PREEMPT_DYNAMIC Mon Jan 29 07:05:48 EST 2024
17-Apr-2024 08:17:46.934 built with '--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '--program-prefix=' '--disable-dependency-tracking' '--prefix=/opt/isc/isc-bind/root/usr' '--exec-prefix=/opt/isc/isc-bind/root/usr' '--bindir=/opt/isc/isc-bind/root/usr/bin' '--sbindir=/opt/isc/isc-bind/root/usr/sbin' '--sysconfdir=/etc/opt/isc/scls/isc-bind' '--datadir=/opt/isc/isc-bind/root/usr/share' '--includedir=/opt/isc/isc-bind/root/usr/include' '--libdir=/opt/isc/isc-bind/root/usr/lib64' '--libexecdir=/opt/isc/isc-bind/root/usr/libexec' '--localstatedir=/var/opt/isc/scls/isc-bind' '--sharedstatedir=/var/opt/isc/scls/isc-bind/lib' '--mandir=/opt/isc/isc-bind/root/usr/share/man' '--infodir=/opt/isc/isc-bind/root/usr/share/info' '--enable-warn-error' '--disable-static' '--enable-dnstap' '--with-pic' '--with-gssapi' '--with-json-c' '--with-libxml2' '--without-lmdb' 'build_alias=x86_64-redhat-linux-gnu' 'host_alias=x86_64-redhat-linux-gnu' 'CC=gcc' 'CFLAGS=-O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -march=x86-64-v2 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -fno-omit-frame-pointer' 'LDFLAGS=-Wl,-z,relro -Wl,--as-needed -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -L/opt/isc/isc-bind/root/usr/lib64' 'CPPFLAGS= -I/opt/isc/isc-bind/root/usr/include' 'LT_SYS_LIBRARY_PATH=/usr/lib64' 'PKG_CONFIG_PATH=:/opt/isc/isc-bind/root/usr/lib64/pkgconfig:/opt/isc/isc-bind/root/usr/share/pkgconfig' 'SPHINX_BUILD=/builddir/build/BUILD/bind-9.18.24/sphinx/bin/sphinx-build'
17-Apr-2024 08:17:46.934 running as: named -g -4 -D testPrimary -n 1 -u named -c /etc/opt/testPrimary/named.conf
17-Apr-2024 08:17:46.934 compiled by GCC 11.4.1 20230605 (Red Hat 11.4.1-2)
17-Apr-2024 08:17:46.934 compiled with OpenSSL version: OpenSSL 3.0.7 1 Nov 2022
17-Apr-2024 08:17:46.934 linked to OpenSSL version: OpenSSL 3.0.7 1 Nov 2022
17-Apr-2024 08:17:46.934 compiled with libuv version: 1.44.2
17-Apr-2024 08:17:46.934 linked to libuv version: 1.44.2
17-Apr-2024 08:17:46.934 compiled with libxml2 version: 2.9.13
17-Apr-2024 08:17:46.934 linked to libxml2 version: 20913
17-Apr-2024 08:17:46.934 compiled with json-c version: 0.14
17-Apr-2024 08:17:46.934 linked to json-c version: 0.14
17-Apr-2024 08:17:46.934 compiled with zlib version: 1.2.11
17-Apr-2024 08:17:46.935 linked to zlib version: 1.2.11
17-Apr-2024 08:17:46.935 ----------------------------------------------------
17-Apr-2024 08:17:46.935 BIND 9 is maintained by Internet Systems Consortium,
17-Apr-2024 08:17:46.935 Inc. (ISC), a non-profit 501(c)(3) public-benefit
17-Apr-2024 08:17:46.935 corporation. Support and training for BIND 9 are
17-Apr-2024 08:17:46.935 available at https://www.isc.org/support
17-Apr-2024 08:17:46.935 ----------------------------------------------------
17-Apr-2024 08:17:46.935 adjusted limit on open files from 524288 to 1048576
17-Apr-2024 08:17:46.935 found 1 CPU, using 1 worker thread
17-Apr-2024 08:17:46.935 using 1 UDP listener per interface
17-Apr-2024 08:17:46.936 DNSSEC algorithms: RSASHA256 RSASHA512 ECDSAP256SHA256 ECDSAP384SHA384 ED25519 ED448
17-Apr-2024 08:17:46.936 DS algorithms: SHA-1 SHA-256 SHA-384
17-Apr-2024 08:17:46.936 HMAC algorithms: HMAC-MD5 HMAC-SHA1 HMAC-SHA224 HMAC-SHA256 HMAC-SHA384 HMAC-SHA512
17-Apr-2024 08:17:46.936 TKEY mode 2 support (Diffie-Hellman): yes
17-Apr-2024 08:17:46.936 TKEY mode 3 support (GSS-API): yes
17-Apr-2024 08:17:46.938 loading configuration from '/etc/opt/testPrimary/named.conf'
17-Apr-2024 08:17:46.938 unable to open '/etc/opt/isc/scls/isc-bind/bind.keys'; using built-in keys instead
17-Apr-2024 08:17:46.940 using default UDP/IPv4 port range: [32768, 60999]
17-Apr-2024 08:17:46.941 listening on IPv4 interface lo, 127.0.0.1#1053
17-Apr-2024 08:17:46.941 generating session key for dynamic DNS
17-Apr-2024 08:17:46.941 sizing zone task pool based on 0 zones
17-Apr-2024 08:17:46.941 none:98: 'max-cache-size 90%' - setting to 1558MB (out of 1732MB)
17-Apr-2024 08:17:46.942 using built-in root key for view _default
17-Apr-2024 08:17:46.942 set up managed keys zone for view _default, file 'managed-keys.bind'
17-Apr-2024 08:17:46.943 command channel listening on 127.0.0.1#1953
17-Apr-2024 08:17:46.943 not using config file logging statement for logging due to -g option
17-Apr-2024 08:17:46.945 managed-keys-zone: loaded serial 2
17-Apr-2024 08:17:46.945 all zones loaded
17-Apr-2024 08:17:46.945 running
17-Apr-2024 08:17:46.979 managed-keys-zone: Key 20326 for zone . is now trusted (acceptance timer complete)
17-Apr-2024 08:17:46.981 resolver priming query complete: success

And when I query it (gratuitous flush) with

rndc -k rndc.key -s localhost -p 1953 flush && dig -4 -p 1053 @localhost www.dnssec-failed.org.

This is what is logged

17-Apr-2024 08:20:13.008 received control channel command 'flush'
17-Apr-2024 08:20:13.010 flushing caches in all views succeeded
17-Apr-2024 08:20:13.030 client @0x7feda09ce768 127.0.0.1#36320 (www.dnssec-failed.org): query: www.dnssec-failed.org IN A +E(0)K (127.0.0.1)
17-Apr-2024 08:20:13.132 resolver priming query complete: success
17-Apr-2024 08:20:13.485 validating www.dnssec-failed.org/A: no valid signature found

And this is the output of dig

; <<>> DiG 9.18.24 <<>> -4 -p 1053 @localhost www.dnssec-failed.org.
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9625
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 9e74c986c617414a01000000661ff6bd07eca9a95d995f7f (good)
;; QUESTION SECTION:
;www.dnssec-failed.org.         IN      A

;; ANSWER SECTION:
www.dnssec-failed.org. 7200    IN      A       68.87.109.242
www.dnssec-failed.org. 7200    IN      A       69.252.193.191

;; Query time: 515 msec
;; SERVER: 127.0.0.1#1053(localhost) (UDP)
;; WHEN: Wed Apr 17 08:20:13 AKDT 2024
;; MSG SIZE rcvd: 110

When I crank the dnssec logging severity to debug-7, I see the following:

17-Apr-2024 08:39:25.601 managed-keys-zone: Creating key fetch in zone_refreshkeys() for '.'
17-Apr-2024 08:39:25.696 managed-keys-zone: Returned from key fetch in keyfetch_done() for '.': success
17-Apr-2024 08:39:25.696 managed-keys-zone: Verifying DNSKEY set for zone '.' using DS 20326/8: success
17-Apr-2024 08:39:25.696 managed-keys-zone: Key 20326 for zone . is now trusted (acceptance timer complete)
17-Apr-2024 08:39:25.697 validating ./NS: starting
17-Apr-2024 08:39:25.698 validating ./NS: attempting positive response validation
17-Apr-2024 08:39:25.698   validating ./DNSKEY: starting
17-Apr-2024 08:39:25.698   validating ./DNSKEY: attempting positive response validation
17-Apr-2024 08:39:25.698   validating ./DNSKEY: verify rdataset (keyid=20326): success
17-Apr-2024 08:39:25.698   validating ./DNSKEY: marking as secure (DS)
17-Apr-2024 08:39:25.698   validator @0x7fb8722b7000: dns_validator_destroy
17-Apr-2024 08:39:25.698 validating ./NS: in validator_callback_dnskey
17-Apr-2024 08:39:25.698 validating ./NS: keyset with trust secure
17-Apr-2024 08:39:25.698 validating ./NS: resuming validate
17-Apr-2024 08:39:25.698 validating ./NS: verify rdataset (keyid=5613): success
17-Apr-2024 08:39:25.698 validating ./NS: marking as secure, noqname proof not needed
17-Apr-2024 08:39:25.698 validator @0x7fb872276c00: dns_validator_destroy
17-Apr-2024 08:40:39.814 validating ./NS: starting
17-Apr-2024 08:40:39.815 validating ./NS: attempting positive response validation
17-Apr-2024 08:40:39.882 validating ./DNSKEY: starting
17-Apr-2024 08:40:39.882 validating ./DNSKEY: attempting positive response validation
17-Apr-2024 08:40:39.883 validating ./DNSKEY: verify rdataset (keyid=20326): success
17-Apr-2024 08:40:39.883 validating ./DNSKEY: marking as secure (DS)
17-Apr-2024 08:40:39.883 validator @0x7fb8722ba200: dns_validator_destroy
17-Apr-2024 08:40:39.883 validating ./NS: in fetch_callback_dnskey
17-Apr-2024 08:40:39.883 validating ./NS: keyset with trust secure
17-Apr-2024 08:40:39.883 validating ./NS: resuming validate
17-Apr-2024 08:40:39.883 validating ./NS: verify rdataset (keyid=5613): success
17-Apr-2024 08:40:39.883 validating ./NS: marking as secure, noqname proof not needed
17-Apr-2024 08:40:39.883 validator @0x7fb8722b7000: dns_validator_destroy
17-Apr-2024 08:40:40.288 validating www.dnssec-failed.org/A: starting
17-Apr-2024 08:40:40.288 validating www.dnssec-failed.org/A: attempting positive response validation
17-Apr-2024 08:40:40.288 validating www.dnssec-failed.org/A: no valid signature found
17-Apr-2024 08:40:40.288 validating www.dnssec-failed.org/A: falling back to insecurity proof
17-Apr-2024 08:40:40.288 validating www.dnssec-failed.org/A: checking existence of DS at 'org'
17-Apr-2024 08:40:40.288   validating org/DS: starting
17-Apr-2024 08:40:40.288   validating org/DS: attempting positive response validation
17-Apr-2024 08:40:40.288   validating org/DS: keyset with trust secure
17-Apr-2024 08:40:40.288   validating org/DS: verify rdataset (keyid=5613): success
17-Apr-2024 08:40:40.289   validating org/DS: marking as secure, noqname proof not needed
17-Apr-2024 08:40:40.289   validator @0x7fb8722b7a00: dns_validator_destroy
17-Apr-2024 08:40:40.289 validating www.dnssec-failed.org/A: in validator_callback_ds
17-Apr-2024 08:40:40.289 validating www.dnssec-failed.org/A: dsset with trust secure
17-Apr-2024 08:40:40.289 validating www.dnssec-failed.org/A: resuming proveunsecure
17-Apr-2024 08:40:40.289 validating www.dnssec-failed.org/A: checking existence of DS at 'dnssec-failed.org'
17-Apr-2024 08:40:40.289   validating dnssec-failed.org/DS: starting
17-Apr-2024 08:40:40.289   validating dnssec-failed.org/DS: attempting positive response validation
17-Apr-2024 08:40:40.322 validating org/DNSKEY: starting
17-Apr-2024 08:40:40.322 validating org/DNSKEY: attempting positive response validation
17-Apr-2024 08:40:40.322 validating org/DNSKEY: verify rdataset (keyid=26974): success
17-Apr-2024 08:40:40.322 validating org/DNSKEY: marking as secure (DS)
17-Apr-2024 08:40:40.322 validator @0x7fb8722b7000: dns_validator_destroy
17-Apr-2024 08:40:40.323   validating dnssec-failed.org/DS: in fetch_callback_dnskey
17-Apr-2024 08:40:40.323   validating dnssec-failed.org/DS: keyset with trust secure
17-Apr-2024 08:40:40.323   validating dnssec-failed.org/DS: resuming validate
17-Apr-2024 08:40:40.323   validating dnssec-failed.org/DS: verify rdataset (keyid=3093): success
17-Apr-2024 08:40:40.323   validating dnssec-failed.org/DS: marking as secure, noqname proof not needed
17-Apr-2024 08:40:40.323   validator @0x7fb8722b7a00: dns_validator_destroy
17-Apr-2024 08:40:40.323 validating www.dnssec-failed.org/A: in validator_callback_ds
17-Apr-2024 08:40:40.323 validating www.dnssec-failed.org/A: dsset with trust secure
17-Apr-2024 08:40:40.323 validating www.dnssec-failed.org/A: resuming proveunsecure
17-Apr-2024 08:40:40.323 validating www.dnssec-failed.org/A: no supported algorithm/digest (dnssec-failed.org/DS)
17-Apr-2024 08:40:40.323 validating www.dnssec-failed.org/A: marking as answer (proveunsecure (2))
17-Apr-2024 08:40:40.323 validator @0x7fb8722b8e00: dns_validator_destroy
--
Do things because you should, not just because you can. 
John Thurston    907-465-8591
john.thurs...@alaska.gov
Department of Administration
State of Alaska
On 4/17/2024 12:26 AM, Nick Tait via bind-users wrote:

If you have just a single process listening on port 53, then I'd suggest using "tail -f" to watch your BIND logs
--
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list

ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.

bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

-- 
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from 
this list

ISC funds the development of this software with paid support subscriptions. 
Contact us at https://www.isc.org/contact/ for more information.


bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

Re: Answers for www.dnssec-failed.org with dnssec-validation auto;

Reply via email to