freeipa

#8647 Incorrect DNSKEY created when DNSSEC enabled for zone
Closed: fixed by frenaud. Opened by frenaud.

Closed: fixed
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 8): Bug 1912556

Description of problem:
When DNSSEC is enabled for the zone two DNSKEYs should be created for the zone:
one KSK key (for trust chain connection from upper level zone) and one ZSK key
for record signing.
Currently two KSK DNSKEYs are created.
Version-Release number of selected component (if applicable):
ipa-selinux-4.8.7-12.module_el8.3.0+511+8a502f20.noarch
ipa-server-dns-4.8.7-12.module_el8.3.0+511+8a502f20.noarch
ipa-common-4.8.7-12.module_el8.3.0+511+8a502f20.noarch
ipa-client-4.8.7-12.module_el8.3.0+511+8a502f20.x86_64
ipa-healthcheck-core-0.4-6.module_el8.3.0+482+9e103aab.noarch
ipa-server-common-4.8.7-12.module_el8.3.0+511+8a502f20.noarch
ipa-server-4.8.7-12.module_el8.3.0+511+8a502f20.x86_64
ipa-server-trust-ad-4.8.7-12.module_el8.3.0+511+8a502f20.x86_64
ipa-client-common-4.8.7-12.module_el8.3.0+511+8a502f20.noarch
How reproducible:
Probably always. Visible in 5 different zones (not yet exposed on the
Internet).
Steps to Reproduce:
1. Create zone as usual.
2. Enable DNSSEC: ipa dnszone-mod <zonename> --dnssec=true
3. Enable NSEC3:  ipa dnszone-mod <zonename> --nsec3param-rec="1 1 10 $(xxd -ps
-l8 -u /dev/urandom)"
Actual results:
2 KSKs attached to the zone.
Expected results:
1 KSK and 1 ZSK attached to the zone.
Additional info:
Key listing from opendnssec:
filippa:~# SOFTHSM2_CONF=/etc/ipa/dnssec/softhsm2.conf ods-enforcer key list -v
-z <xxx>.eu
Keys:
Zone:                           Keytype: State:    Date of next transition:
Size: Algorithm: CKA_ID:                          Repository: KeyTag:
<xxx>.eu                        KSK      publish   2021-01-05 08:43:35
3072  8          820cd89ce8c3bc9d191e6f1afc664fe4 SoftHSM     36710
<xxx>.eu                        ZSK      ready     2021-01-05 08:43:35
2048  8          250d09a4724d46676e4b7fe0b77eb9ba SoftHSM     24045
Please note keytypes in the listing above: 1 KSK & 1 ZSK.
dig output:
filippa:~# dig <xxx>.eu dnskey +short +rrcomments
257 3 8 AwEAAbv1+PERvOibE315J7G0z6X9G/gXzCYQjO53E1jawFy+Jskg/aQ8
A5o5cWlR8ip5z4TLH1qwRUznvbZAWUNi26EqSCLL/oEYLfl8ibexRWip
5i12D1lxPtl4j6rYDUMeLmu7Nmt6uMRyG8FmzwKKmNLG76U4EJTjGgO+
7xdDzU9U6pppwxJD3RCeuYFHn78pxsNwnEOYo5ICOCXCHuTZw6YWq1oH
JY+nuzBhtFlU82T4p2MoqvNlfRjd+85yIgJVImvXpyMLWBTVcgpv1goY
nb3wF3LMlWJU8wZVLTXuJjQrXWyfnrATzGe7lKmMRNxhtvGoEXAmRjFP 4auS74Oh1SE=  ; KSK;
alg = RSASHA256 ; key id = 24046
257 3 8 AwEAAcCeLyVFPsCDR2b8q1cB4O+qPzroVdyN56/SseHPFwHsEXwHqbOD
HKWKl8inUc2fDK0rboPP0CrMxxTDWC+JDY4CCqGZcYO8YeIR04BRb9A9
IiCvtWvxBo8qNhLvDGFhFaUHVWIsJfBl+PtkgmbbwGZ6k7JuO1vnxCVc
sP9ZvLfFqdj6CeIGhCmISKTZ/iNYIX4hZ1o7NrYhD+o6d+f3v69Q8Q9F
8aTUeG5KwDPlYQMMyI6SxKaSO1lR/8DrCAdn7KOMW6hZmB9b+l5t4RrW
/eJ76DlISHGpxZTUkXGRDKah6yGpDK0CyQRa8uUPsQ6WJ3V/xyWF0SJ1
0HRPk3OwgqUm6iSukOdBIgIb6Gfrtxpsi6VkLiq2QDGOFou6RD7F5ddU
tvlao+AWrnQ75HqyHvvzjtYHEXTsBCXb+9oWEDi0jfaFlKVeO+xmKKd5
6NuzBAwzSRsgtucxAqjB+IB6Yt8DEW+jaH7J10NUkeMiQEFD/hW26Gsg DdaZIZaLTI2Ihw==  ;
KSK; alg = RSASHA256 ; key id = 36710
Please note BOTH keys are marked as KSK (both in comments and by keyflags in
the first field: 257).

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1912556

Metadata Update from @frenaud:
- Issue assigned to frenaud

Metadata Update from @frenaud:
- Issue tagged with: test-failure

The test test_integration/test_dnssec.py::TestInstallDNSSECFirst::test_chain_of_trust is also failing while checking the chain of signature using drill command, likely related to this issue. Please see PR #649, test_dnssec.

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/5444

master:

  • cdfc86364ee2eed2aafda2e8b3a484a7a264677e dnssec: fix the key type with OpenDNSSEC 2.1
  • 7902c784963c64b2d0fba8e7fa03529e793c221c ipatests: add a test for ZSK/KSK keytype in DNSKEY record
  • ca17a81a30cc83568008bad9031db3b8c6b90f2f OpenDNSSEC: fix timezone in key creation date

ipa-4-9:

  • 44762369fb05b67855a8dc81d647c8880d642902 dnssec: fix the key type with OpenDNSSEC 2.1
  • dd21d068cb4500b0d8a8af14b0371f95cc40c974 ipatests: add a test for ZSK/KSK keytype in DNSKEY record
  • 2a51892ab9688b6bc5282098a426003932462549 OpenDNSSEC: fix timezone in key creation date

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

ipa-4-8:

  • c02544c07d040e4e96ed17233b479c958a68b8fa azure: bump F32->F34
  • 7802e14f5e209512fc736af56972f572bc599bec freeipa.spec: do not use jsl for linting on Fedora 34+
  • 7433be926c6e084f7f1f3bead060544a1334c86e azure: Collect systemd boot log
  • 523a9f863815cccfa05f0f87269d6b448a5ab12a azure: Enforce multi-user.target as default systemd's target
  • 677df148c7d606242ae14665e3d0580f12e972b3 azure: Wait for systemd booted
  • 04c90fb4f2fb16e932f5d198cacb31c75dc9b955 azure: Remove no longer needed repo
  • 8fea2f6f3573cd18f6d1cf2af5f95f0f5da2a643 azure: Mask systemd-resolved
  • 976a3bf4c388e71c3dc85c8c50b9c727bc07de65 ipatests: Update expectations for test_detect_container
  • e5731634a17aa96f4efa235f12bcca993726e6fc azure: Add workaround for PhantomJS against OpenSSL 1.1.1
  • 01237953a21b80219ebd6665e0eb67558a951a83 azure: Warn about memory issues
  • 835df314d65f42c2e36ac52737eecc1f4e9536e6 BIND: Setup logging
  • 2a9dea81254accb08a114a0e853a4c485d1082e4 ipatests: Setup and collect BIND logs
  • e23f9767ce2d509c00efa3c0fa5684e7a1fe1973 azure: Run Base and XMLRPC tests is isolated network
  • 34e1f6ab3971468a0fa485fe7588e469632d3d0f ipatests: Handle network-isolated mode
  • c8e5867d01e4a3a75f7abebf08caf29bbeae5eb6 dnsutil: Improvements for IPA DNS Resolver
  • fe0b5ff449da473a69449f7c3267e4a17245a753 dns: get_reverse_zone: Ignore resolver's timeout
  • d40306b90527337e504d019797ffb41b7c13d035 pytest: Show extra summary information for all except passed tests
  • ff70aacbf8f9035ec496c5e8ea8b23ac6724a8c6 ipatests: Ignore warnings on failed to read files on tarring
  • cb3b396fbbbf11462597a7289d5a89cb9fe2cbc9 ipatests: Suppress list trust or certificates
  • 21a520181f0e8c2a1e19b3a9e559fd77d9df4b04 azure: Collect installed packages
  • c65c7eb05779425355266486c02a30d9cc1f9659 ipatests: dnssec: Add alternative approach for checking chain of trust
  • 6710ff42ea853a5dcee96ab64a72051fb4e3f6f7 azure: Warn about extra and missing gating tests compared to PR-CI
  • a5730f5053a706c9ce93ef7ec4c52f44b32ca432 azure: Re-balance tests envs
  • e66eb48ac43ec513b1e787dcb0da3ee7f7ea3908 azure: coredump: Wait for systemd fully booted
  • 6561fc689800c390b8a05cec01e3e69e563edebb ipatests: re-add test_dnssec.py::TestInstallDNSSECFirst in gating
  • 8bf95380f1e3608be993e90c0005742db1cb9090 azure: Make it possible to adjust Docker resources per test env
  • 2a7f21a9c308cba33edf9ffa43c4aaf271e3a612 ipa-kdb: fix gcc complaints in kdb tests
  • e94261f9d9a09dbeca581dfe77f0ae94d2cb1c0b Set client keytab location for 389ds
  • ba6eb857ee7abf0fdead07a86e60b0308935ed38 dnssec: fix the key type with OpenDNSSEC 2.1
  • 7daf47c83a11ee9cf63462bef8c34a4899054623 ipatests: add a test for ZSK/KSK keytype in DNSKEY record
  • b8242e64ee7765d17746281192eaefc4f8fd7dcc handle Y2038 in timestamp to datetime conversions
  • 5bfe16a8182f2a2903d12ddd93c9d86a20cae198 OpenDNSSEC: fix timezone in key creation date
  • 56746ec0055803b8f6c73c382bed1132a950c0df freeipa.spec: bump the required version of 389ds
  • 2b8ccc8a1ec00fe2b4054f169233092c12d78522 freeipa.spec: synchronize with Fedora for 389-ds and PKI versions
  • a8686043a521ab115e21700c7782f3fad8ee9752 ipatests: collect config files for NetworkManager and systemd-resolved
  • bc9ca47fbd006a533a5f520fe303913b56b13712 ipatests: add utility for managing domain name resolvers
  • cdc78af9d77e22b27fc13d3a82e511f7693dff89 ipatests: setup resolvers during replica and client installations
  • 549ef48c4bf749919fcd93a7ee71641c180b1687 ipatests: do not manually modify /etc/resolv.conf in tests
  • 324ba203ebdd5e8ca5837d40a549c6f43e214d13 ipatests: disable systemd-resolved cache
  • 9a28022e4792a905137da9b8a463057473a86499 ipatests: mock resolver factory
  • 63a3cfff967eadc8b8ca07ab82ea47d876cc8491 ipatests: always try to create A records for hosts in IPA domain
  • d9744e7fa3a9ada6af44b993047fde6521f9bac3 ipatests: do not configure nameserver when installing client and replica
  • 47e9df18cd85295e02dd96c95d5888a84aaceaae ipatests: fix TestInstalDNSSECFirst::test_resolvconf logic
  • bca86ced8dd4fc36685137b32361e311ba34c04f pr-ci: Run tests on F34
  • 0b8517d6f1f09ce246ef2e6c5305099ceec8ac48 Revert "ipatests: configure client to use IPA server as DNS resolver"
  • d43d9ca8afa20c83010a3e862e806936414631fc ipatests: Fetch sudo rules without time offset
Metadata

test-failure

None
None
None
https://github.com/freeipa/freeipa/pull/5444
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.