{"action":"created","issue":{"url":"https://api.github.com/repos/systemd/systemd/issues/4175","repository_url":"https://api.github.com/repos/systemd/systemd","labels_url":"https://api.github.com/repos/systemd/systemd/issues/4175/labels{/name}","comments_url":"https://api.github.com/repos/systemd/systemd/issues/4175/comments","events_url":"https://api.github.com/repos/systemd/systemd/issues/4175/events","html_url":"https://github.com/systemd/systemd/issues/4175","id":177622780,"number":4175,"title":"systemd-resolved: after network reconnection, DNSSEC unsigned zones treated as bogus, stop resolving","user":{"login":"andersk","id":26471,"avatar_url":"https://avatars.githubusercontent.com/u/26471?v=3","gravatar_id":"","url":"https://api.github.com/users/andersk","html_url":"https://github.com/andersk","followers_url":"https://api.github.com/users/andersk/followers","following_url":"https://api.github.com/users/andersk/following{/other_user}","gists_url":"https://api.github.com/users/andersk/gists{/gist_id}","starred_url":"https://api.github.com/users/andersk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andersk/subscriptions","organizations_url":"https://api.github.com/users/andersk/orgs","repos_url":"https://api.github.com/users/andersk/repos","events_url":"https://api.github.com/users/andersk/events{/privacy}","received_events_url":"https://api.github.com/users/andersk/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/systemd/systemd/labels/bug","name":"bug","color":"e11d21"},{"url":"https://api.github.com/repos/systemd/systemd/labels/resolve","name":"resolve","color":"d4c5f9"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/systemd/systemd/milestones/9","html_url":"https://github.com/systemd/systemd/milestones/v232","labels_url":"https://api.github.com/repos/systemd/systemd/milestones/9/labels","id":1893375,"number":9,"title":"v232","description":"","creator":{"login":"keszybz","id":349618,"avatar_url":"https://avatars.githubusercontent.com/u/349618?v=3","gravatar_id":"","url":"https://api.github.com/users/keszybz","html_url":"https://github.com/keszybz","followers_url":"https://api.github.com/users/keszybz/followers","following_url":"https://api.github.com/users/keszybz/following{/other_user}","gists_url":"https://api.github.com/users/keszybz/gists{/gist_id}","starred_url":"https://api.github.com/users/keszybz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/keszybz/subscriptions","organizations_url":"https://api.github.com/users/keszybz/orgs","repos_url":"https://api.github.com/users/keszybz/repos","events_url":"https://api.github.com/users/keszybz/events{/privacy}","received_events_url":"https://api.github.com/users/keszybz/received_events","type":"User","site_admin":false},"open_issues":20,"closed_issues":38,"state":"open","created_at":"2016-07-20T03:20:34Z","updated_at":"2016-10-11T18:07:22Z","due_on":null,"closed_at":null},"comments":5,"created_at":"2016-09-18T01:49:14Z","updated_at":"2016-10-11T20:53:41Z","closed_at":null,"body":"### Submission type\r\n\r\n  - [X] Bug report\r\n  - [ ] Request for enhancement (RFE)\r\n\r\n### systemd version the issue has been seen with\r\n\r\n231\r\n\r\n### Used distribution\r\n\r\nUbuntu 16.10\r\n\r\n### In case of bug report: Expected behaviour you didn't see\r\n\r\nsystemd-resolved continues resolving after I disconnect and reconnect the network.\r\n\r\n### In case of bug report: Unexpected behaviour you saw\r\n\r\nOn the MIT network (which runs some ancient version of BIND 9), systemd-resolved stops resolving anything that isn’t DNSSEC-signed after I disconnect and reconnect the network. Signed zones continue to resolve.\r\n\r\nThis happens with either `DNSSEC=yes` or the default `DNSSEC=allow-downgrade`.\r\n\r\n### In case of bug report: Steps to reproduce the problem\r\n\r\n```sh-session\r\n$ systemd-resolve github.com\r\ngithub.com: 192.30.253.113\r\n\r\n-- Information acquired via protocol DNS in 15.6ms.\r\n-- Data is authenticated: no\r\n$ # (disconnect and reconnect wifi)\r\n$ systemd-resolve github.com\r\ngithub.com: resolve call failed: DNSSEC validation failed: no-signature\r\n```\r\n\r\n[Full log from `SYSTEMD_LOG_LEVEL=debug /lib/systemd/systemd-resolved`](https://github.com/systemd/systemd/files/478472/debug.txt) across the reconnection.  Here’s the part where `github.com` fails to resolve after the reconnection.\r\n\r\n```\r\nGot message type=method_call sender=:1.12138 destination=org.freedesktop.resolve1 object=/org/freedesktop/resolve1 interface=org.freedesktop.resolve1.Manager member=ResolveHostname cookie=2 reply_cookie=0 error=n/a\r\nLooking up RR for github.com IN A.\r\nLooking up RR for github.com IN AAAA.\r\nSent message type=method_call sender=n/a destination=org.freedesktop.DBus object=/org/freedesktop/DBus interface=org.freedesktop.DBus member=AddMatch cookie=80 reply_cookie=0 error=n/a\r\nGot message type=method_return sender=org.freedesktop.DBus destination=:1.12117 object=n/a interface=n/a member=n/a cookie=65 reply_cookie=80 error=n/a\r\nSent message type=method_call sender=n/a destination=org.freedesktop.DBus object=/org/freedesktop/DBus interface=org.freedesktop.DBus member=GetNameOwner cookie=81 reply_cookie=0 error=n/a\r\nGot message type=method_return sender=org.freedesktop.DBus destination=:1.12117 object=n/a interface=n/a member=n/a cookie=66 reply_cookie=81 error=n/a\r\nCache miss for github.com IN A\r\nTransaction 7392 for <github.com IN A> scope dns on */*.\r\nUsing feature level UDP+EDNS0+DO+LARGE for transaction 7392.\r\nUsing DNS server 18.70.0.160 for transaction 7392.\r\nSending query packet with id 7392.\r\nProcessing incoming packet on transaction 7392.\r\nRequesting SOA to validate transaction 7392 (github.com, unsigned non-SOA/NS RRset <github.com IN A 192.30.253.112>).\r\nCache miss for github.com IN SOA\r\nTransaction 64818 for <github.com IN SOA> scope dns on */*.\r\nUsing feature level UDP+EDNS0+DO+LARGE for transaction 64818.\r\nUsing DNS server 18.70.0.160 for transaction 64818.\r\nSending query packet with id 64818.\r\nProcessing incoming packet on transaction 64818.\r\nRequesting DS to validate transaction 64818 (github.com, unsigned SOA/NS RRset).\r\nCache miss for github.com IN DS\r\nTransaction 24924 for <github.com IN DS> scope dns on */*.\r\nUsing feature level UDP+EDNS0+DO+LARGE for transaction 24924.\r\nUsing DNS server 18.70.0.160 for transaction 24924.\r\nSending query packet with id 24924.\r\nProcessing incoming packet on transaction 24924.\r\nRequesting DNSKEY to validate transaction 24924 (com, RRSIG with key tag: 27452).\r\nPositive cache hit for com IN DNSKEY\r\nTransaction 55432 for <com IN DNSKEY> on scope dns on */* now complete with <success> from cache (authenticated).\r\nRequesting parent SOA to validate transaction 24924 (github.com, unsigned empty DS response).\r\nPositive cache hit for com IN SOA\r\nTransaction 2111 for <com IN SOA> on scope dns on */* now complete with <success> from cache (authenticated).\r\nValidating response from transaction 24924 (github.com IN DS).\r\nLooking at com IN SOA a.gtld-servers.net nstld.verisign-grs.com 1474161818 1800 900 604800 86400: validated\r\nFound verdict for lookup com IN SOA: secure\r\nFound verdict for lookup github.com IN DS: bogus\r\nDNSSEC validation failed for question github.com IN DS: no-signature\r\nTransaction 24924 for <github.com IN DS> on scope dns on */* now complete with <dnssec-failed> from network (unsigned).\r\nAuxiliary DNSSEC RR query failed validation: no-signature\r\nDNSSEC validation failed for question github.com IN SOA: no-signature\r\nTransaction 64818 for <github.com IN SOA> on scope dns on */* now complete with <dnssec-failed> from network (unsigned).\r\nAuxiliary DNSSEC RR query failed validation: no-signature\r\nDNSSEC validation failed for question github.com IN A: no-signature\r\nTransaction 7392 for <github.com IN A> on scope dns on */* now complete with <dnssec-failed> from network (unsigned).\r\nSent message type=error sender=n/a destination=:1.12138 object=n/a interface=n/a member=n/a cookie=82 reply_cookie=2 error=DNSSEC validation failed: no-signature\r\nSent message type=method_call sender=n/a destination=org.freedesktop.DBus object=/org/freedesktop/DBus interface=org.freedesktop.DBus member=RemoveMatch cookie=83 reply_cookie=0 error=n/a\r\nGot message type=method_return sender=org.freedesktop.DBus destination=:1.12117 object=n/a interface=n/a member=n/a cookie=67 reply_cookie=83 error=n/a\r\nFreeing transaction 7392.\r\nFreeing transaction 64818.\r\nFreeing transaction 24924.\r\nFreeing transaction 55432.\r\nFreeing transaction 2111.\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/systemd/systemd/issues/comments/253042688","html_url":"https://github.com/systemd/systemd/issues/4175#issuecomment-253042688","issue_url":"https://api.github.com/repos/systemd/systemd/issues/4175","id":253042688,"user":{"login":"andersk","id":26471,"avatar_url":"https://avatars.githubusercontent.com/u/26471?v=3","gravatar_id":"","url":"https://api.github.com/users/andersk","html_url":"https://github.com/andersk","followers_url":"https://api.github.com/users/andersk/followers","following_url":"https://api.github.com/users/andersk/following{/other_user}","gists_url":"https://api.github.com/users/andersk/gists{/gist_id}","starred_url":"https://api.github.com/users/andersk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andersk/subscriptions","organizations_url":"https://api.github.com/users/andersk/orgs","repos_url":"https://api.github.com/users/andersk/repos","events_url":"https://api.github.com/users/andersk/events{/privacy}","received_events_url":"https://api.github.com/users/andersk/received_events","type":"User","site_admin":false},"created_at":"2016-10-11T20:53:41Z","updated_at":"2016-10-11T20:53:41Z","body":"My network management software is NetworkManager. This report is from the part of the Ubuntu 16.10 development cycle where NetworkManager was configured without `dns=dnsmasq` to let systemd-resolved get more testing, but otherwise there’s nothing unusual about my setup.\r\n\r\nHow could this race condition be closed? Is NetworkManager supposed to wait for some acknowledgement from systemd-resolved that the new DNS servers have been picked up before configuring the IP settings?"}}
{"actor":{"display_login":"andersk"}}