Debian Bug report logs - #960023
SSHFP stops working with libc6 2.31 [AD bit stripped]

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Iain Lane <laney@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: SSHFP stops working with libc6 2.31 [AD bit stripped]

Date: Fri, 08 May 2020 13:32:21 +0100

[Message part 1 (text/plain, inline)]

Package: ssh,systemd
Severity: normal

Hey

I've just been playing with SSHFP as a way of verifying SSH host keys
(VerifyHostKeyDNS=yes) when I can trust my local DNS resolver. I was
trying on Ubuntu 20.04 and I could just *not* get it to work. It was
considering the response to be untrusted. I'll spare you all of the
tedious details of the many things I tried, but it comes down to this.

As of 2.31, glibc's stub resolver is stripping the AD (authenticated
data) bit from resposes that it receives from its upstream name servers.
This is documented in the release notes for 2.31:

  * The DNS stub resolver will optionally send the AD (authenticated
    data) bit in queries if the trust-ad option is set via the options
    directive in /etc/resolv.conf (or if RES_TRUSTAD is set in
    _res.options).  In this mode, the AD bit, as provided by the name
    server, is available to applications which call res_search and
    related functions.  In the default mode, the AD bit is not set in
    queries, and it is automatically cleared in responses, indicating a
    lack of DNSSEC validation.  (Therefore, the name servers and the
    network path to them are treated as untrusted.)

and a couple of relevant links

  https://gnutoolchain-gerrit.osci.io/r/c/glibc/+/461
  https://bugzilla.redhat.com/show_bug.cgi?id=1164339#c15

I'm filing this on *both* SSH and systemd, since I think either or both
are places that might want to consider being altered to account for
this and I'd be interested in the maintainers' opinions.

openssh
=======

In Debian we are patching ssh to unconditionally send EDNS0, even if not
specified in /etc/resolve.conf, in an effort to support this feature.
Sending TRUSTAD too is arguably in keeping with the spirit of this
patch. I tried this in the attached patch and it works.

systemd
=======

systemd-resolved similarly adds 'options edns0' to resolv.conf files it
generates for its stub resolver. It could be extended (untested) to add
the 'trust-ad' option.

Counterargument
===============

I'm not very well-read here yet, but it seems like this is done because
AD can be faked by malicious resolvers, and so the argument is that it's
not safe to trust it unless you know you're in a trusted environment. In
that light, perhaps what ssh and systemd are doing (adding edns0 to make
the AD bit be sent automatically) is working against upstream glibc's
goal, and so we shouldn't do this for users without their opt-in? This
is where I'd appreciate the input of wiser heads.

If this type of argument is accepted, it would be good to provide a
simple way to turn trust-ad on so that people can do it when they are on
trusted networks. (Maybe even with higher-level support from something
like network-manager too.)

Cheers,

-- 
Iain Lane                                  [ iain@orangesquash.org.uk ]
Debian Developer                                   [ laney@debian.org ]
Ubuntu Developer                                   [ laney@ubuntu.com ]

[ssh_res_trustad.patch (text/plain, attachment)]

Message #10 received at 960023@bugs.debian.org (full text, mbox, reply):

From: Michael Biebl <biebl@debian.org>

To: Iain Lane <laney@debian.org>, 960023@bugs.debian.org

Subject: Re: Bug#960023: SSHFP stops working with libc6 2.31 [AD bit stripped]

Date: Sun, 10 May 2020 09:33:34 +0200

[Message part 1 (text/plain, inline)]

Hi Iain

Am 08.05.20 um 14:32 schrieb Iain Lane:
> systemd
> =======
> 
> systemd-resolved similarly adds 'options edns0' to resolv.conf files it
> generates for its stub resolver. It could be extended (untested) to add
> the 'trust-ad' option.


Could you please raise this at
https://github.com/systemd/systemd/issues

To me this sounds like something that should be discussed (and
eventually implemented) upstream .

[signature.asc (application/pgp-signature, attachment)]

Message #15 received at 960023@bugs.debian.org (full text, mbox, reply):

From: Iain Lane <laney@debian.org>

To: Michael Biebl <biebl@debian.org>

Cc: 960023@bugs.debian.org

Subject: Re: Bug#960023: SSHFP stops working with libc6 2.31 [AD bit stripped]

Date: Sun, 10 May 2020 09:25:57 +0100

[Message part 1 (text/plain, inline)]

Control: forwarded -1 https://github.com/systemd/systemd/issues/15767

On Sun, May 10, 2020 at 09:33:34AM +0200, Michael Biebl wrote:
> Hi Iain
> 
> Am 08.05.20 um 14:32 schrieb Iain Lane:
> > systemd
> > =======
> > 
> > systemd-resolved similarly adds 'options edns0' to resolv.conf files it
> > generates for its stub resolver. It could be extended (untested) to add
> > the 'trust-ad' option.
> 
> 
> Could you please raise this at
> https://github.com/systemd/systemd/issues
> 
> To me this sounds like something that should be discussed (and
> eventually implemented) upstream .

Of course. I filed it here because I wanted to see if the Debian
maintainers had any thoughts first (and because the SSH behaviour is a
Debian patch).

Here you go: https://github.com/systemd/systemd/issues/15767

Cheers,

-- 
Iain Lane                                  [ iain@orangesquash.org.uk ]
Debian Developer                                   [ laney@debian.org ]
Ubuntu Developer                                   [ laney@ubuntu.com ]

[signature.asc (application/pgp-signature, inline)]

Message #24 received at 960023@bugs.debian.org (full text, mbox, reply):

From: Michael Biebl <biebl@debian.org>

To: Iain Lane <laney@debian.org>, 960023@bugs.debian.org

Subject: Re: Bug#960023: SSHFP stops working with libc6 2.31 [AD bit stripped]

Date: Mon, 27 Jul 2020 21:36:23 +0200

[Message part 1 (text/plain, inline)]

Control: reassing -1 ssh
Control: found -1 1:8.3p1-1
Control: notforwarded -1

Hi Iain

Am 10.05.20 um 10:25 schrieb Iain Lane:
> Control: forwarded -1 https://github.com/systemd/systemd/issues/15767
> 
> On Sun, May 10, 2020 at 09:33:34AM +0200, Michael Biebl wrote:
>> Hi Iain
>>
>> Am 08.05.20 um 14:32 schrieb Iain Lane:
>>> systemd
>>> =======
>>>
>>> systemd-resolved similarly adds 'options edns0' to resolv.conf files it
>>> generates for its stub resolver. It could be extended (untested) to add
>>> the 'trust-ad' option.
>>
>>
>> Could you please raise this at
>> https://github.com/systemd/systemd/issues
>>
>> To me this sounds like something that should be discussed (and
>> eventually implemented) upstream .
> 
> Of course. I filed it here because I wanted to see if the Debian
> maintainers had any thoughts first (and because the SSH behaviour is a
> Debian patch).
> 
> Here you go: https://github.com/systemd/systemd/issues/15767

In the mean time,
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965371 was filed as a
duplicate of this bug report.
I'm going to keep #965371 assigned to systemd and will reassign this one
to ssh.

Regards,
Michael

[signature.asc (application/pgp-signature, attachment)]

Send a report that this bug log contains spam.