Unsupported DNSSEC algorithms should not lead to SERVFAIL.

[Petr Menšík]

Ok, fair enough, there are differences. Not obvious from reading the 
text of issues only, it seems exactly the same issue on the first glance.

Filled https://gitlab.isc.org/isc-projects/bind9/-/issues/5622 to track 
just the issue reported in stable releases.

The core seems to be related. Especially "no valid signature found" is 
the first message in delv +vtrace, which is different from working 
version output.

Ok, this bug does not need any special behavior of delegation. It 
deserves own issue then, right.

On 04/11/2025 13:27, Ondřej Surý wrote:
> Agreed.
>
> I would suggest doing a full bug report into an issue next time and including all the relevant details instead of piggybacking on an internal issue.
>
> There is a subtle difference between #5570 and the issue reported below, and thus these are two distinct bugs.
>
> Ondrej
> --
> Ondřej Surý (He/Him)
> ondrej at isc.org
>
> My working hours and your working hours may be different. Please do not feel obligated to reply outside your normal working hours.
>
>> On 4. 11. 2025, at 7:21, Petr Menšík via bind-users <bind-users at lists.isc.org> wrote:
>>
>> Unfortunately this is a rare moment, when Ondřej is not correct. This affects all versions, which included fix for CVE-2025-8677. Yes, I verified also our builds are affected. Fedora 9.18.41 contains the same problem, but OpenSSL library does not prevent usage of 5 and 7 algorithms there. It is not visible.
>>
>> But in any case, similar reports should contain delv +vtrace output from your side. Especially because it should be able to reproduce it on any system, which disables RSASHA1 and RSASHA1NSEC3 algorithms. But delv tool shows wrong behaviour only on CentOS 9 or CentOS 10 derivatives. On other systems it seems unaffected on the first glance.
>>
>> Development version contains code modifications, which has similar problem in a bit different place and with different fix needed. But unlike original assumption it affects also stable versions.
>>
>> Cheers,
>> Petr
>>
>> On 30/10/2025 22:39, Ondřej Surý wrote:
>> -- 
>> Petr Menšík
>> Senior Software Engineer, RHEL
>> Red Hat, https://www.redhat.com/
>> PGP: DFCF908DB7C87E8E529925BC4931CA5B6C9FC5CB
>>
>> -- 
>> Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list.

-- 
Petr Menšík
Senior Software Engineer, RHEL
Red Hat, https://www.redhat.com/
PGP: DFCF908DB7C87E8E529925BC4931CA5B6C9FC5CB