[GH-ISSUE #2949] Authoritative: No data responses are missing NSEC3 record for wildcard name when expanding to more than one label #1099

New issue

Open

opened 2026-03-16 01:36:10 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 01:36:10 +03:00

Owner

Originally created by @divergentdave on GitHub (Apr 25, 2025).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2949

InnerInMemory::proof() has a separate check for wildcard expansion responses when handling NXDOMAIN or no data responses. This is separate from the check in build_authoritative_response(), which relies on the presence of wildcard records in positive responses. Note that InnerInMemory::inner_lookup_wildcard() handles finding wildcard matches in the zone for positive responses. The check in InnerInMemory::proof(), for negative responses, only checks qname.into_wildcard(). This is incorrect, because we need to check each possible wildcard name that could have expanded to the query name. This is causing the integration test invalid_nsec3_tests::wildcard_no_data_error to fail, because the DNSSEC validator reports the response is bogus before any NSEC3 records have been removed.

Originally created by @divergentdave on GitHub (Apr 25, 2025). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2949 `InnerInMemory::proof()` has a separate check for wildcard expansion responses when handling NXDOMAIN or no data responses. This is separate from the check in `build_authoritative_response()`, which relies on the presence of wildcard records in positive responses. Note that `InnerInMemory::inner_lookup_wildcard()` handles finding wildcard matches in the zone for positive responses. The check in `InnerInMemory::proof()`, for negative responses, only checks `qname.into_wildcard()`. This is incorrect, because we need to check each possible wildcard name that could have expanded to the query name. This is causing the integration test `invalid_nsec3_tests::wildcard_no_data_error` to fail, because the DNSSEC validator reports the response is bogus before any NSEC3 records have been removed.