[Touch-packages] [Bug 1624071] Re: libnss-resolve: Fallback from resolve to dns breaks DNSSEC validation

2019-05-16 Thread Bug Watch Updater
** Changed in: systemd Status: Unknown => Fix Released -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to systemd in Ubuntu. https://bugs.launchpad.net/bugs/1624071 Title: libnss-resolve: Fallback from resolve to dns br

[Touch-packages] [Bug 1624071] Re: libnss-resolve: Fallback from resolve to dns breaks DNSSEC validation

2016-12-13 Thread nitrogen
Calin: see https://bugs.launchpad.net/ubuntu/+source/nss- mdns/+bug/1641328 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to systemd in Ubuntu. https://bugs.launchpad.net/bugs/1624071 Title: libnss-resolve: Fallback from res

[Touch-packages] [Bug 1624071] Re: libnss-resolve: Fallback from resolve to dns breaks DNSSEC validation

2016-11-07 Thread Martin Pitt
Calin: This sounds like something entirely unrelated. Can you please file a new bug? -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to systemd in Ubuntu. https://bugs.launchpad.net/bugs/1624071 Title: libnss-resolve: Fallback

[Touch-packages] [Bug 1624071] Re: libnss-resolve: Fallback from resolve to dns breaks DNSSEC validation

2016-11-07 Thread Calin Cerghedean
Glad to see this has been reported. On my system, I can no longer get to any local nodes by referring to the hostname, so it is pretty clear that hostname resolution is not working. I was able to circumvent the behavior for only 1 Linux machine by specifying nodename.local, but that doesn't wo

[Touch-packages] [Bug 1624071] Re: libnss-resolve: Fallback from resolve to dns breaks DNSSEC validation

2016-10-02 Thread Launchpad Bug Tracker
This bug was fixed in the package systemd - 231-9git1 --- systemd (231-9git1) yakkety; urgency=medium * systemctl: Add --wait option to wait until started units terminate again. This is a prerequisite for using systemd for graphical sessions without ugly polling. * nss-res

[Touch-packages] [Bug 1624071] Re: libnss-resolve: Fallback from resolve to dns breaks DNSSEC validation

2016-10-02 Thread Martin Pitt
** Changed in: systemd (Ubuntu) Status: In Progress => Fix Committed -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to systemd in Ubuntu. https://bugs.launchpad.net/bugs/1624071 Title: libnss-resolve: Fallback from res

[Touch-packages] [Bug 1624071] Re: libnss-resolve: Fallback from resolve to dns breaks DNSSEC validation

2016-10-01 Thread Martin Pitt
** Changed in: systemd (Ubuntu) Status: Triaged => In Progress ** Changed in: systemd (Ubuntu) Milestone: ubuntu-16.11 => ubuntu-16.10 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to systemd in Ubuntu. https://bugs

[Touch-packages] [Bug 1624071] Re: libnss-resolve: Fallback from resolve to dns breaks DNSSEC validation

2016-09-27 Thread Martin Pitt
** Changed in: systemd (Ubuntu) Milestone: ubuntu-16.10 => ubuntu-16.11 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to systemd in Ubuntu. https://bugs.launchpad.net/bugs/1624071 Title: libnss-resolve: Fallback from res

[Touch-packages] [Bug 1624071] Re: libnss-resolve: Fallback from resolve to dns breaks DNSSEC validation

2016-09-15 Thread Martin Pitt
Upstream PR sent with a possible fix: https://github.com/systemd/systemd/pull/4164 With that "resolve [!UNAVAIL=return] dns" does the right thing. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to systemd in Ubuntu. https://bug

[Touch-packages] [Bug 1624071] Re: libnss-resolve: Fallback from resolve to dns breaks DNSSEC validation

2016-09-15 Thread Martin Pitt
** Also affects: systemd via https://github.com/systemd/systemd/issues/4157 Importance: Unknown Status: Unknown ** Changed in: systemd (Ubuntu) Assignee: (unassigned) => Martin Pitt (pitti) ** Changed in: systemd (Ubuntu) Importance: Undecided => Medium ** Changed in: system

[Touch-packages] [Bug 1624071] Re: libnss-resolve: Fallback from resolve to dns breaks DNSSEC validation

2016-09-15 Thread Anders Kaseorg
Filed https://github.com/systemd/systemd/issues/4157 upstream for the NOTFOUND vs. UNAVAIL problem. ** Bug watch added: github.com/systemd/systemd/issues #4157 https://github.com/systemd/systemd/issues/4157 -- You received this bug notification because you are a member of Ubuntu Touch seeded

[Touch-packages] [Bug 1624071] Re: libnss-resolve: Fallback from resolve to dns breaks DNSSEC validation

2016-09-15 Thread Anders Kaseorg
** Description changed: The libnss-resolve postinst script inserts ‘resolve’ before ‘dns’ in the hosts line of /etc/nsswitch.conf. This makes DNSSEC validation impossible, even with DNSSEC=yes in /etc/systemd/resolved.conf, because if libnss_resolve returns a validation failure, glibc wil

[Touch-packages] [Bug 1624071] Re: libnss-resolve: Fallback from resolve to dns breaks DNSSEC validation

2016-09-15 Thread Anders Kaseorg
You’re right: glibc seems to treat the absence of libnss-resolve itself as UNAVAIL, which is the same code returned on DNSSEC validation failures when libnss-resolve is working. I don’t see a way around this other than patching libnss-resolve to return NOTFOUND (or TRYAGAIN?) on validation failure

[Touch-packages] [Bug 1624071] Re: libnss-resolve: Fallback from resolve to dns breaks DNSSEC validation

2016-09-15 Thread Martin Pitt
Thanks for reporting this, well spotted! The reason for having "dns" is *not* to guard against failures of resolved -- if the daemon is not running, then nss-resolve already falls back to glibc's resolver (i. e. "dns"). The reason is that libnss-resolve itself might not be available. E. g. you mi

[Touch-packages] [Bug 1624071] Re: libnss-resolve: Fallback from resolve to dns breaks DNSSEC validation

2016-09-15 Thread Anders Kaseorg
I also worry that, by masking systemd-resolved failures, this fallback has meant that systemd-resolved is not really getting adequate testing. If there were widespread problems causing systemd-resolved lookups to fail, would anyone have noticed? -- You received this bug notification because you a