[GH-ISSUE #2734] CDS delete records cause a parser error #1053

New issue

Closed

opened 2026-03-16 01:26:51 +03:00 by kerem · 2 comments

kerem commented

2026-03-16 01:26:51 +03:00

Owner

Originally created by @TheEnbyperor on GitHub (Jan 23, 2025).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2734

Originally assigned to: @divergentdave on GitHub.

RFC 8078 section 4 describes the delete algorithm for CDS/CDNSKEY records. Hickory does not handle the 0 in the CDS digest field type. The RFC states that "this is not a definition of DS digest algorithm 0", thus the IANA registry referenced in the hickory source code was not updated to include an algorithm 0.

As a consequence of this the DigestType enum in Hickory errors on being presented with an algorithm 0. This is the correct behaviour in the case of a DS record, but is incorrect for CDS.

Currently the CDS struct is a direct encapsulation of the DS struct. From this I see two possibilities for fixing this:

the CDS struct is changed to not be a direct encapsulation of the DS struct, and to have Option<DigestType>
the DigistType enum allows 0 value algorithms, although this technically breaks spec compatibility for DS records.

On a related note the error for this condition could also do with some improvement. The current error is:

incorrect rdata length read: 4 expected: 5

Imo, this should instead be some more meaningful error about the unrecognised algorithm identifier.

System:
Irrelevant

Version:
Crate: proto
Version: 0.24.2, problem also present in Git HEAD

Originally created by @TheEnbyperor on GitHub (Jan 23, 2025). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2734 Originally assigned to: @divergentdave on GitHub. [RFC 8078 section 4](https://datatracker.ietf.org/doc/html/rfc8078#section-4) describes the delete algorithm for CDS/CDNSKEY records. Hickory does not handle the `0` in the CDS digest field type. The RFC states that "this is not a definition of DS digest algorithm 0", thus the [IANA registry referenced in the hickory source code](https://www.iana.org/assignments/ds-rr-types/ds-rr-types.xhtml) was not updated to include an algorithm 0. As a consequence of this the [DigestType](https://github.com/hickory-dns/hickory-dns/blob/b14b2394c2aba748c57703b7f2895b7758ab7906/crates/proto/src/dnssec/mod.rs#L72) enum in Hickory errors on being presented with an algorithm 0. This is the correct behaviour in the case of a DS record, but is incorrect for CDS. Currently the CDS struct is a direct encapsulation of the DS struct. From this I see two possibilities for fixing this: - the CDS struct is changed to not be a direct encapsulation of the DS struct, and to have `Option<DigestType>` - the DigistType enum allows 0 value algorithms, although this technically breaks spec compatibility for DS records. On a related note the error for this condition could also do with some improvement. The current error is: ```text incorrect rdata length read: 4 expected: 5 ``` Imo, this should instead be some more meaningful error about the unrecognised algorithm identifier. **System:** Irrelevant **Version:** Crate: proto Version: 0.24.2, problem also present in Git HEAD

kerem closed this issue

2026-03-16 01:26:56 +03:00

kerem commented

2026-03-16 01:27:02 +03:00

Author

Owner

@djc commented on GitHub (Jan 24, 2025):

Something closer to the former suggestion sounds optimal. Would you be able to submit a PR for this?

(Independently of any fixes, improvements to errors are very welcome, too!)

@djc commented on GitHub (Jan 24, 2025): Something closer to the former suggestion sounds optimal. Would you be able to submit a PR for this? (Independently of any fixes, improvements to errors are very welcome, too!)

kerem commented

2026-03-16 01:27:07 +03:00

Author

Owner

@divergentdave commented on GitHub (Jan 30, 2025):

I'm working on a fix for #2695, and I'm going to roll a fix for this into it, so we don't just treat 0 as an unsupported digest type.

@divergentdave commented on GitHub (Jan 30, 2025): I'm working on a fix for #2695, and I'm going to roll a fix for this into it, so we don't just treat 0 as an unsupported digest type.

kerem referenced this issue

2026-03-16 03:43:07 +03:00

[PR #1053] [MERGED] Bump ring from 0.16.11 to 0.16.12 #1924