[GH-ISSUE #2714] DNSSEC validation incorrectly returning bogus instead of insecure #1045

New issue

Closed

opened 2026-03-16 01:25:22 +03:00 by kerem · 1 comment

kerem commented

2026-03-16 01:25:22 +03:00

Owner

Originally created by @divergentdave on GitHub (Jan 10, 2025).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2714

Describe the bug
With some zones, the Hickory DNS validating recursive resolver incorrectly gets a bogus validation result instead of an insecure validation result in cases where there's a signed proof of nonexistence of a DS record.

To Reproduce
The ede-dot-com tests for unsigned.extended-dns-errors.com and no-ds.extended-dns-errors.com demonstrate this.

Originally created by @divergentdave on GitHub (Jan 10, 2025). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2714 **Describe the bug** With some zones, the Hickory DNS validating recursive resolver incorrectly gets a bogus validation result instead of an insecure validation result in cases where there's a signed proof of nonexistence of a DS record. **To Reproduce** The ede-dot-com tests for `unsigned.extended-dns-errors.com` and `no-ds.extended-dns-errors.com` demonstrate this.

kerem closed this issue

2026-03-16 01:25:28 +03:00

kerem commented

2026-03-16 01:25:33 +03:00

Author

Owner

@divergentdave commented on GitHub (Jan 29, 2025):

This is due to a NSEC3 validation bug. The root cause is a case-sensitive comparison of base32-encoded hash labels: github.com/hickory-dns/hickory-dns@5df2783517/crates/proto/src/dnssec/dnssec_dns_handle/nsec3_validation.rs (L547)

The zones signed and served by BIND use uppercase labels, while the validation routine encodes hashes into lowercase labels here. I'm going to work on a fix for this, and look for any other similar comparisons.

@divergentdave commented on GitHub (Jan 29, 2025): This is due to a NSEC3 validation bug. The root cause is a case-sensitive comparison of base32-encoded hash labels: https://github.com/hickory-dns/hickory-dns/blob/5df2783517c7edff9ad1a67ca3c3c6a1dd2d4b3c/crates/proto/src/dnssec/dnssec_dns_handle/nsec3_validation.rs#L547 The zones signed and served by BIND use uppercase labels, while the validation routine encodes hashes into lowercase labels here. I'm going to work on a fix for this, and look for any other similar comparisons.

kerem referenced this issue

2026-03-16 03:27:40 +03:00

[PR #1045] [CLOSED] Bump time from 0.1.42 to 0.2.9 #1915

kerem referenced this issue

2026-03-16 03:42:51 +03:00

[PR #1045] [CLOSED] Bump time from 0.1.42 to 0.2.9 #1917