Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-88037

Pagure #9748: Server installation: dot-forwarder not added as a forwarder

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • ipa-4.12.2-16.el9
    • No
    • Low
    • 2
    • rhel-idm-ipa
    • ssg_idm
    • 10
    • 12
    • 2
    • QE ack, Dev ack
    • False
    • False
    • Hide

      None

      Show
      None
    • No
    • 2025-Q2-Alpha-S4, 2025-Q2-Alpha-S6
    • Unspecified Release Note Type - Unknown
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      Cloned from: https://pagure.io/freeipa/issue/9748
      
      ### Issue
      When installing a server with DNS and DNS over TTL, the DoT forwarder is not added as a forwarder.
      
      #### Steps to Reproduce
      1. install a machine with freeipa-server-encrypted-dns package:
      ```
      # dnf copr enable -y @freeipa/freeipa-master-nightly
      # dnf install -y freeipa-server-dns freeipa-server-encrypted-dns
      ```
      2. Configure IPA server with encrypted dns
      ```
      # ipa-server-install --domain ipa.test --realm IPA.TEST --setup-dns --dns-over-tls --dot-forwarder "1.1.1.1#cloudflare-dns.com" -a Secret123 -p Secret123 -U
      ```
      3. Check the forwarders with
      ```
      # echo Secret123 | kinit admin
      # ipa dnsconfig-show
      # ipa dnsserver-show `hostname`
      ```
      
      #### Actual behavior
      The DoT forwarder is not configured as a DNS forwarder.
      
      ```
      # ipa dnsconfig-show
      ---------------------------------
      Global DNS configuration is empty
      ---------------------------------
        IPA DNS servers: server.ipa.test
      #  ipa dnsserver-show `hostname`
        Server name: server.ipa.test
        SOA mname override: server.ipa.test.
        Forwarders: 127.0.0.55
        Forward policy: first
      ```
      
      #### Expected behavior
      The DoT forwarder should be added to the list of forwarders for the DNS server and appear in the output of `ipa dnsserver-show`
      
      #### Version/Release/Distribution
      ```
      # rpm -q freeipa-server
      freeipa-server-4.13.0.dev202502131605+git-0.fc41.x86_64
      ```
      
      #### Additional info:
      Seems to be related to a typo in the code:
      in ipaserver/install/dns.py lines [439-440](https://github.com/freeipa/freeipa/blob/018b3d3dc6d26ec50f73aaea675ecfb8813aaea1/ipaserver/install/dns.py#L439-L440):
      ```
          if not options.forwarders and options.dot_forwarders:
              options.forwaders = [fw.split("#")[0] for fw in options.dot_forwarders]
      ```
      Note the missing r in forw**ad**ers
      

              frenaud@redhat.com Florence Renaud
              frenaud@redhat.com Florence Renaud
              Florence Renaud Florence Renaud
              Sudhir Menon Sudhir Menon
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated:
                Resolved: