starred/hickory-dns

Fork 0

mirror of https://github.com/hickory-dns/hickory-dns.git synced 2026-04-25 03:05:51 +03:00

[GH-ISSUE #2500] [resolver] ResolverOpts::authentic_data wrong documentation or wrong default and setting has no effect #1005

New issue

Closed

opened 2026-03-16 01:14:39 +03:00 by kerem · 5 comments

kerem commented

2026-03-16 01:14:39 +03:00

Owner

Originally created by @kolbma on GitHub (Oct 8, 2024).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2500

Here it says it is true by default...

github.com/hickory-dns/hickory-dns@7887002d11/crates/resolver/src/config.rs (L905-L906)

But in ResolverOpts::default() it is set to false: github.com/hickory-dns/hickory-dns@7887002d11/crates/resolver/src/config.rs (L941)

And also whatever this value is set to, my lookup_ip() queries become always sent with AD bit set.

Originally created by @kolbma on GitHub (Oct 8, 2024). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2500 Here it says it is true by default... https://github.com/hickory-dns/hickory-dns/blob/7887002d1198ed9faaaae531e0f9815c10589f7a/crates/resolver/src/config.rs#L905-L906 But in `ResolverOpts::default()` it is set to false: https://github.com/hickory-dns/hickory-dns/blob/7887002d1198ed9faaaae531e0f9815c10589f7a/crates/resolver/src/config.rs#L941 And also whatever this value is set to, my `lookup_ip()` queries become always sent with __AD bit set__.

kerem

2026-03-16 01:14:39 +03:00

closed this issue
added the
trust

cleanup

crate:resolver

compliance
labels

kerem commented

2026-03-16 01:14:56 +03:00

Author

Owner

@djc commented on GitHub (Oct 8, 2024):

And also whatever this value is set to, my lookup_ip() queries become always sent with AD bit set.

What version are you using? Might be good to try with 0.25.0-alpha.2.

@djc commented on GitHub (Oct 8, 2024): > And also whatever this value is set to, my `lookup_ip()` queries become always sent with **AD bit set**. What version are you using? Might be good to try with 0.25.0-alpha.2.

kerem commented

2026-03-16 01:15:01 +03:00

Author

Owner

@kolbma commented on GitHub (Oct 8, 2024):

And also whatever this value is set to, my lookup_ip() queries become always sent with AD bit set.

What version are you using? Might be good to try with 0.25.0-alpha.2.

No change.

@kolbma commented on GitHub (Oct 8, 2024): > > And also whatever this value is set to, my `lookup_ip()` queries become always sent with **AD bit set**. > > What version are you using? Might be good to try with 0.25.0-alpha.2. No change.

kerem commented

2026-03-16 01:15:06 +03:00

Author

Owner

@djc commented on GitHub (Oct 9, 2024):

Would be good if you can provide a minimal reproduction example of the allegedly incorrect behavior.

@djc commented on GitHub (Oct 9, 2024): Would be good if you can provide a minimal reproduction example of the allegedly incorrect behavior.

kerem commented

2026-03-16 01:15:11 +03:00

Author

Owner

@kolbma commented on GitHub (Oct 9, 2024):

I've commented in code...

use std::net::SocketAddr;

use hickory_resolver::{
    config::{NameServerConfig, Protocol, ResolverConfig, ResolverOpts},
    Resolver,
};

#[test]
fn lookup_without_ad_flag() {
    let socket_addr = "1.1.1.1:53".parse::<SocketAddr>().expect("invalid address");

    let name_servers = [
        NameServerConfig {
            socket_addr,
            protocol: Protocol::Udp,
            tls_dns_name: None,
            trust_negative_responses: false,
            bind_addr: None,
        },
        NameServerConfig {
            socket_addr,
            protocol: Protocol::Tcp,
            tls_dns_name: None,
            trust_negative_responses: false,
            bind_addr: None,
        },
    ]
    .to_vec();

    let resolver_config = ResolverConfig::from_parts(None, vec![], name_servers);
    let mut resolver_opts = ResolverOpts::default();

    // Set this to true or false, the query looks always the same, the flag doesn't change anything
    resolver_opts.authentic_data = false;

    // The query needs to be checked in a packet sniffer...
    // With validate == true:  Query flags are always 0x0120, the authentic_data setting above doesn't change anything
    // With validate == false: Query flags are always 0x0100, the authentic_data setting above doesn't change anything
    resolver_opts.validate = true;

    let resolver = Resolver::new(resolver_config, resolver_opts).expect("resolver fail");

    let lookup_ips = resolver.lookup_ip("www.github.com");

    if lookup_ips.is_ok() {
        dbg!(lookup_ips.unwrap());
    } else {
        dbg!(lookup_ips.unwrap_err());
    }
}

@kolbma commented on GitHub (Oct 9, 2024): I've commented in code... ```rust use std::net::SocketAddr; use hickory_resolver::{ config::{NameServerConfig, Protocol, ResolverConfig, ResolverOpts}, Resolver, }; #[test] fn lookup_without_ad_flag() { let socket_addr = "1.1.1.1:53".parse::<SocketAddr>().expect("invalid address"); let name_servers = [ NameServerConfig { socket_addr, protocol: Protocol::Udp, tls_dns_name: None, trust_negative_responses: false, bind_addr: None, }, NameServerConfig { socket_addr, protocol: Protocol::Tcp, tls_dns_name: None, trust_negative_responses: false, bind_addr: None, }, ] .to_vec(); let resolver_config = ResolverConfig::from_parts(None, vec![], name_servers); let mut resolver_opts = ResolverOpts::default(); // Set this to true or false, the query looks always the same, the flag doesn't change anything resolver_opts.authentic_data = false; // The query needs to be checked in a packet sniffer... // With validate == true: Query flags are always 0x0120, the authentic_data setting above doesn't change anything // With validate == false: Query flags are always 0x0100, the authentic_data setting above doesn't change anything resolver_opts.validate = true; let resolver = Resolver::new(resolver_config, resolver_opts).expect("resolver fail"); let lookup_ips = resolver.lookup_ip("www.github.com"); if lookup_ips.is_ok() { dbg!(lookup_ips.unwrap()); } else { dbg!(lookup_ips.unwrap_err()); } } ```

kerem commented

2026-03-16 01:15:16 +03:00

Author

Owner

@divergentdave commented on GitHub (Mar 3, 2025):

First of all, queries from security-aware resolvers are required to have AD=0, and security-aware name servers are required to ignore the AD bit in queries. (We have a conformance test for the resolver in resolver::dnssec::rfc4035::section_4::section_4_6::clears_ad_bit_in_outgoing_queries) Secondly, the authentic_data field of ResolverOpts is not currently used anywhere, nor was it used anywhere when it was introduced in #1710. We should just remove this option.

Edit: also, note that the doc comment of this field is copied from recursion_desired above, where it makes more sense.

@divergentdave commented on GitHub (Mar 3, 2025): First of all, queries from security-aware resolvers are required to have AD=0, and security-aware name servers are required to ignore the AD bit in queries. (We have a conformance test for the resolver in `resolver::dnssec::rfc4035::section_4::section_4_6::clears_ad_bit_in_outgoing_queries`) Secondly, the `authentic_data` field of `ResolverOpts` is not currently used anywhere, nor was it used anywhere when it was introduced in #1710. We should just remove this option. Edit: also, note that the doc comment of this field is copied from `recursion_desired` above, where it makes more sense.

kerem referenced this issue

2026-03-16 08:53:50 +03:00

[PR #1586] [MERGED] Configuration of bind address for resolver. #2436