<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>No, RRSIG should never be looked up manually. You just send query
with DO bit enabled and expect to receive all RRSIGs for all
records in the reply. If the server fails to include RRSIG, but
manual query would work, it should be fixed on server side.</p>
<p>If your change has modified only this problem, I guess we should
have only test ensuring it works with a correct reply.</p>
<p>If any such problem occurs again, contact the service operator or
fill at least issue at:</p>
<p><a class="moz-txt-link-freetext" href="https://github.com/dns-violations/dns-violations">https://github.com/dns-violations/dns-violations</a></p>
<p>Cheers,<br>
Petr<br>
</p>
<div class="moz-cite-prefix">On 4/28/22 21:03, Chris via
Dnsmasq-discuss wrote:<br>
</div>
<blockquote type="cite"
cite="mid:bd32af3d-0074-48f8-b914-e61427f4ecd4@yourdreamnet.co.uk">
<div dir="auto">Hi all,<br>
<br>
</div>
<div dir="auto">Following on from Peter's comments, I went back to
Cloudflare and they have fixed their upstream server.<br>
<br>
</div>
<div dir="auto">I'm not sure if it's dnsmasq's job to look up the
RRSIG of an A record delivered with a CNAME, but either way, my
original problem is now solved.<br>
<br>
</div>
<div dir="auto">If you think this is still something that should
be supported, I'm happy to look into it some more, but probably
not.<br>
<br>
</div>
<div dir="auto">Thanks all for your input on this.<br>
<br>
</div>
<div class="gmail_quote">On 22 Apr 2022, at 07:57, Peter van Dijk
<<a href="mailto:peter.van.dijk@powerdns.com" target="_blank"
moz-do-not-send="true" class="moz-txt-link-freetext">peter.van.dijk@powerdns.com</a>>
wrote:
<blockquote class="gmail_quote">
<pre class="blue">Hi Chris,
you replied only to me, and not to the list - in case that was on
purpose, this reply is also only to you. Feel free to take this back to
the list.
Given names x and y, with x in an unsigned zone and y in a signed zone,
and the following content in those two zones:
x CNAME y
y A <a href="http://192.0.2.1" moz-do-not-send="true">192.0.2.1</a>
y RRSIG A ...
your upstream, when asked to do DNSSEC, should give the RRSIG A for
both queries 'x A' and 'y A'. If it does not, it is broken. I'm not
sure it's dnsmasq's job to compensate for this.
Cheers, Peter
On Thu, 2022-04-21 at 23:04 +0100, Chris Staite wrote:
<blockquote class="gmail_quote"> Yes,
And having spent the evening looking at the problem again, I now see that my fix isn’t actually the correct solution.
The issue is actually that the server replies with the CNAME and no RRSIG for it (because it’s not signed) and the A records for the CNAME (but no RRSIG values for them). If a query is done separately for the target of the CNAME the RRSIG for the A records are returned.
I’m not sure if this is an issue with dnsmasq (whether it should request the A records for the CNAME target as if they weren’t returned already) or if the upstream server really ought to reply with the RRSIG values in the original reply.
I’ve got some code in test that detects the lack of RRSIG and removes it from the response, but I’m still trying to figure out how to get dnsmasq to re-query for the A records and get the RRSIG itself.
Thanks, Chris.
<blockquote class="gmail_quote"> On 21 Apr 2022, at 18:36, Peter van Dijk <a class="moz-txt-link-rfc2396E" href="mailto:peter.van.dijk@powerdns.com"><peter.van.dijk@powerdns.com></a> wrote:
On Fri, 2022-04-15 at 00:19 +0100, Chris Staite via Dnsmasq-discuss
wrote:
<blockquote class="gmail_quote"> It does require the CNAME to come before the A record, but I think that’s required in the standard anyway
</blockquote>
This is not something you can rely on. Records can get reordered for
many reasons.
Kind regards,
--
Peter van Dijk
PowerDNS.COM BV - <a href="https://www.powerdns.com" moz-do-not-send="true" class="moz-txt-link-freetext">https://www.powerdns.com</a>/
<hr>
Dnsmasq-discuss mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Dnsmasq-discuss@lists.thekelleys.org.uk">Dnsmasq-discuss@lists.thekelleys.org.uk</a>
<a href="https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss" moz-do-not-send="true" class="moz-txt-link-freetext">https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss</a>
</blockquote>
</blockquote>
</pre>
</blockquote>
</div>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
Dnsmasq-discuss mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Dnsmasq-discuss@lists.thekelleys.org.uk">Dnsmasq-discuss@lists.thekelleys.org.uk</a>
<a class="moz-txt-link-freetext" href="https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss">https://lists.thekelleys.org.uk/cgi-bin/mailman/listinfo/dnsmasq-discuss</a>
</pre>
</blockquote>
<pre class="moz-signature" cols="72">--
Petr Menšík
Software Engineer
Red Hat, <a class="moz-txt-link-freetext" href="http://www.redhat.com/">http://www.redhat.com/</a>
email: <a class="moz-txt-link-abbreviated" href="mailto:pemensik@redhat.com">pemensik@redhat.com</a>
PGP: DFCF908DB7C87E8E529925BC4931CA5B6C9FC5CB</pre>
</body>
</html>