From owner-freebsd-pkg@freebsd.org Sun May 2 18:55:03 2021 Return-Path: Delivered-To: freebsd-pkg@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id E75A962D598 for ; Sun, 2 May 2021 18:55:03 +0000 (UTC) (envelope-from patrick.prugger@uname.at) Received: from mail.uname.at (mail.uname.at [116.202.23.57]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4FYFfG2dTCz3CCp; Sun, 2 May 2021 18:55:02 +0000 (UTC) (envelope-from patrick.prugger@uname.at) Received: from mail.uname.at (localhost [127.0.0.1]) by mail.uname.at (Postfix) with ESMTP id B26C021C08; Sun, 2 May 2021 20:54:59 +0200 (CEST) From: To: "'Ryan Steinmetz'" Cc: , References: <0a0c01d73ece$22f1dc60$68d59520$@uname.at> In-Reply-To: Subject: AW: DNSSEC Errors on geo.freebsd.org Date: Sun, 2 May 2021 20:54:56 +0200 Message-ID: <002801d73f84$a590eb50$f0b2c1f0$@uname.at> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Thread-Index: AQHwyv/Ctb3Vf728hH/7q/mmjMCTDwLnGvjdAiH1TBOqdSn9UA== Content-Language: de X-Virus-Scanned: ClamAV using ClamSMTP X-Rspamd-Queue-Id: 4FYFfG2dTCz3CCp X-Spamd-Bar: ---- X-Spamd-Result: default: False [-4.10 / 15.00]; ARC_NA(0.00)[]; RBL_DBL_DONT_QUERY_IPS(0.00)[116.202.23.57:from]; R_DKIM_ALLOW(-0.20)[uname.at:s=2018]; RCVD_IN_DNSWL_LOW(-0.10)[116.202.23.57:from]; RCPT_COUNT_THREE(0.00)[3]; TO_DN_SOME(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; R_SPF_ALLOW(-0.20)[+a:mail.uname.at]; MIME_GOOD(-0.10)[text/plain]; NEURAL_HAM_LONG(-1.00)[-1.000]; SPAMHAUS_ZRD(0.00)[116.202.23.57:from:127.0.2.255]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; DKIM_TRACE(0.00)[uname.at:+]; DMARC_POLICY_ALLOW(-0.50)[uname.at,reject]; FROM_NO_DN(0.00)[]; NEURAL_HAM_SHORT(-1.00)[-1.000]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+]; RCVD_TLS_LAST(0.00)[]; ASN(0.00)[asn:24940, ipnet:116.202.0.0/16, country:DE]; MID_RHS_MATCH_FROM(0.00)[]; MAILMAN_DEST(0.00)[freebsd-pkg]; RCVD_COUNT_TWO(0.00)[2] X-BeenThere: freebsd-pkg@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Binary package management and package tools discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 02 May 2021 18:55:04 -0000 Hello everyone! After hours of debugging I found out it actually seems to be a bug in = the TLS interface of unbound 1.9.0.2 I just patched to unbound 1.13.1 from buster-backports and now it works. Thanks for your help! Best regards Patrick Prugger -----Urspr=FCngliche Nachricht----- Von: Ryan Steinmetz =20 Gesendet: Sonntag, 2. Mai 2021 01:23 An: Rainer Duffner Cc: patrick.prugger@uname.at; freebsd-pkg@freebsd.org; = dnsadm@freebsd.org Betreff: Re: DNSSEC Errors on geo.freebsd.org On (05/02/21 01:05), Rainer Duffner wrote: > > >> Am 01.05.2021 um 23:08 schrieb patrick.prugger--- via freebsd-pkg : >> >> Hello everyone! >> >> I just turned on DNSSEC validation on my DNS and it came to my eye=20 >> that pkg now doesn't work anymore. >> Pkg is trying to access http://pkgmir.geo.freebsd.org/ to download de = >> repository catalogue. >> >> Unfortunately it seems freebsd.org is signed with DNSSEC, but=20 >> geo.freebsd.org isn't which leads to a DNSSEC error, broken chain of trust. >> For a diagram look here: >> https://dnsviz.net/d/pkgmir.geo.freebsd.org/dnssec/ >> There's no error here and this host does indeed work fine with a = validating recursive resolver. geo.freebsd.org is delegated to a separate set of nameservers which = handle geo-based replies. DNSSEC is intentionally not present on the zone as = the software that responds with dynamic replies and does not currently = support signing those. You should investigate your setup a bit more. -r >> Does anyone here have a contact to the maintainers of the freebsd.org = >> DNS zone? >> > >https://www.freebsd.org/administration/#t-dnsadm > > > -- Ryan Steinmetz PGP: 9079 51A3 34EF 0CD4 F228 EDC6 1EF8 BA6B D028 46D7