19 Říj
2021
19 Říj
'21
17:30
On 19/10/2021 12.49, Matthew Richardson wrote:
Thanks for your detailed report and instructions. I've reproduced the
issue and it does seem like a DNSSEC validation bug in Knot Resolver.
Since it's reproducible, we should hopefully be able to fix that soon.
I've created an issue to track the bug.
https://gitlab.nic.cz/knot/knot-resolver/-/issues/679
--
Tomas Krizek
PGP: 4A8B A48C 2AED 933B D495 C509 A1FB A5F7 EF8C 4869
Dear Tomas,
On 18/10/21 11:56, Tomas Krizek wrote:
Having seen the post about 5.4.2-1.el8 being available from epel-testing, I
tried upgrading to it. The results remain a reproducible SERVFAIL using
the same procedure.
On 16/10/2021 19.50, Matthew Richardson wrote:
Yes, I can reproduce the issue every time with this procedure:-
Whilst setting up Knot Resolver (version 5.4.1 on
Rocky 8), it fails to
resolve 213-133-203-34.newtel.in-addr.itconsult.net with a cold cache, but
succeeds if the cache has been specifically warmed. With the cold cache
SERVFAIL is returned and it logs:-
> Oct 16 18:40:52 dt05 kresd[36140]: [dnssec] validation failure:
213-133-203-34.newtel.in-addr.itconsult.net. PTR
Hi,
I can't reproduce this behaviour. I get NOERROR even with cold cache.
What does your configuration look like? Is the issue reproducible in
your environment?