Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-56280

systemd-resolved: Add option to disable AAAA queries

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • Icon: Story Story
    • Resolution: Unresolved
    • Icon: Minor Minor
    • None
    • None
    • systemd
    • Low
    • rhel-systemd
    • ssg_core_services
    • 5
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • x86_64
    • None

      Goal

      • As a user, i would want systemd-resolved to not allow any IPv6 AAAA queries with a small configuration change.
      • Background: We have RHEL9 servers with IPv6 disabled in kernel, however our DNS still gives IPv6 addresses, while no-aaaa option in /etc/resolv.conf would solve this, the problem is that the support for no-aaaa only available to applications that use glibc.
      • With this patch, i can set "DisableAAAAQuery=yes" in resolved.conf and any AAAA queries to systemd-resolved will be given a REFUSED message. However, IPv4 A records will still resolve.

      Acceptance Criteria

       

      • Verify `DisableAAAAQuery=yes` in /etc/systemd/resolved.conf: systemd-resolved will return DNS REFUSED for IPv6 AAAA queries while IPv4 A queries remain unaffected.
      • Verify `DisableAAAAQuery=no` in /etc/systemd/resolved.conf: systemd-resolved will return both IPv6 AAAA and IPv4 A records.
      • Verify by removing DisableAAAAQuery completely in /etc/systemd/resolved.conf: systemd-resolved will return both IPv6 AAAA and IPv4 A records.

        1. 0732-option-to-disable-ipv6-aaaa-queries.patch
          4 kB
          Muhammad Nuzaihan Kamal Luddin
        2. 1043-refuse-record-types.patch
          15 kB
          Muhammad Nuzaihan Kamal Luddin

              systemd-maint systemd maint mailing list
              muhammadnuzaihan@paynet.my Muhammad Nuzaihan Kamal Luddin
              Muhammad Nuzaihan Kamal Luddin
              systemd maint mailing list systemd maint mailing list
              Frantisek Sumsal Frantisek Sumsal
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated: