[PR #2084] [MERGED] Better DNSSEC proofs #2797

New issue

Closed

opened 2026-03-16 11:08:43 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:08:43 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/2084
Author: @bluejekyll
Created: 10/30/2023
Status: ✅ Merged
Merged: 3/2/2024
Merged by: @bluejekyll

Base: main ← Head: better-dnssec-proofs

📝 Commits (10+)

73c9ef7 Add Proof type for DNSSEC
6868895 Add Proof to NSEC results
098611e make dnssec methods more type safe
d5d82a6 change internal usage from set_rr_type to set_record_type
d0a7b92 remove with deprecation
609f87a Notes on changes to dnssec proof, and unwrap RRSIG from Record
9aff9d5 remove unnecessary clones of rrsig in dnssec
91d2746 add Proof to resource::Record
12ff904 add a test for Secure records
f7c3a70 add in additionals for validation

📊 Changes

32 files changed (+1198 additions, -645 deletions)

View changed files

📝 Cargo.lock (+2 -0)
📝 Cargo.toml (+1 -0)
📝 crates/proto/Cargo.toml (+3 -2)
📝 crates/proto/src/error.rs (+16 -21)
📝 crates/proto/src/op/edns.rs (+1 -1)
📝 crates/proto/src/rr/dnssec/mod.rs (+8 -15)
➕ crates/proto/src/rr/dnssec/proof.rs (+405 -0)
📝 crates/proto/src/rr/dnssec/signer.rs (+23 -26)
📝 crates/proto/src/rr/dnssec/tbs.rs (+11 -5)
📝 crates/proto/src/rr/dnssec/verifier.rs (+1 -1)
📝 crates/proto/src/rr/mod.rs (+2 -2)
📝 crates/proto/src/rr/resource.rs (+132 -52)
📝 crates/proto/src/rr/rr_set.rs (+17 -17)
📝 crates/proto/src/serialize/txt/zone.rs (+1 -1)
📝 crates/proto/src/xfer/dns_multiplexer.rs (+6 -6)
📝 crates/proto/src/xfer/dns_response.rs (+7 -1)
📝 crates/proto/src/xfer/dnssec_dns_handle.rs (+361 -364)
📝 crates/resolver/src/async_resolver.rs (+7 -20)
📝 crates/resolver/src/lookup.rs (+83 -9)
📝 crates/resolver/src/lookup_ip.rs (+2 -4)

...and 12 more files

📄 Description

I've taken an initial stab at cleaning up the DNSSEC validation and move to associating a Proof to each record. This differs a little bit from what was discussed in #1708 as I think this might be the best option.

This adds a Proof enum that has the Secure, Bogus, Insecure, and Indeterminate as members.
Once validated it associates that proof to the Record, there's more cleanup here as we only support Secure records being returned at the moment, and even though we can detect Bogus, it's returned as an Error right now, which I think we decided we want to move away from.

I still need to add the Insecure path, but before I do that I wanted to see if anyone wanted to offer early feedback. Also, I want to reduce more cloning. I was able to remove quite a bit that was still there from before async/await was finalized. I think there's more yet that can be done.

Fixes: #1708
Fixes: #2095
Fixes: #1650

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/2084 **Author:** [@bluejekyll](https://github.com/bluejekyll) **Created:** 10/30/2023 **Status:** ✅ Merged **Merged:** 3/2/2024 **Merged by:** [@bluejekyll](https://github.com/bluejekyll) **Base:** `main` ← **Head:** `better-dnssec-proofs` --- ### 📝 Commits (10+) - [`73c9ef7`](https://github.com/hickory-dns/hickory-dns/commit/73c9ef7db5aa263d581d052a19a7cc5a0796cb37) Add Proof type for DNSSEC - [`6868895`](https://github.com/hickory-dns/hickory-dns/commit/68688959ff277007c915f7401de6020a3afa48bc) Add Proof to NSEC results - [`098611e`](https://github.com/hickory-dns/hickory-dns/commit/098611ec84cb81753e25fc7ae9f6371188bb71e9) make dnssec methods more type safe - [`d5d82a6`](https://github.com/hickory-dns/hickory-dns/commit/d5d82a61343676d6dc9f743290ae4b16cf41398a) change internal usage from set_rr_type to set_record_type - [`d0a7b92`](https://github.com/hickory-dns/hickory-dns/commit/d0a7b920371fdda314ae9caae0f3b61cd00b9d30) remove with deprecation - [`609f87a`](https://github.com/hickory-dns/hickory-dns/commit/609f87a94c7e11e801c632cadf5c6991888cad5e) Notes on changes to dnssec proof, and unwrap RRSIG from Record - [`9aff9d5`](https://github.com/hickory-dns/hickory-dns/commit/9aff9d58f267047e767994c638432d67f0e3f7cd) remove unnecessary clones of rrsig in dnssec - [`91d2746`](https://github.com/hickory-dns/hickory-dns/commit/91d27466f43c19cfbafa8720b3d8f111e0351244) add Proof to resource::Record - [`12ff904`](https://github.com/hickory-dns/hickory-dns/commit/12ff904cf18628b0966b4608e073ee05c2e683bc) add a test for Secure records - [`f7c3a70`](https://github.com/hickory-dns/hickory-dns/commit/f7c3a70153278d248d3e12788abc59413be45897) add in additionals for validation ### 📊 Changes **32 files changed** (+1198 additions, -645 deletions) <details> <summary>View changed files</summary> 📝 `Cargo.lock` (+2 -0) 📝 `Cargo.toml` (+1 -0) 📝 `crates/proto/Cargo.toml` (+3 -2) 📝 `crates/proto/src/error.rs` (+16 -21) 📝 `crates/proto/src/op/edns.rs` (+1 -1) 📝 `crates/proto/src/rr/dnssec/mod.rs` (+8 -15) ➕ `crates/proto/src/rr/dnssec/proof.rs` (+405 -0) 📝 `crates/proto/src/rr/dnssec/signer.rs` (+23 -26) 📝 `crates/proto/src/rr/dnssec/tbs.rs` (+11 -5) 📝 `crates/proto/src/rr/dnssec/verifier.rs` (+1 -1) 📝 `crates/proto/src/rr/mod.rs` (+2 -2) 📝 `crates/proto/src/rr/resource.rs` (+132 -52) 📝 `crates/proto/src/rr/rr_set.rs` (+17 -17) 📝 `crates/proto/src/serialize/txt/zone.rs` (+1 -1) 📝 `crates/proto/src/xfer/dns_multiplexer.rs` (+6 -6) 📝 `crates/proto/src/xfer/dns_response.rs` (+7 -1) 📝 `crates/proto/src/xfer/dnssec_dns_handle.rs` (+361 -364) 📝 `crates/resolver/src/async_resolver.rs` (+7 -20) 📝 `crates/resolver/src/lookup.rs` (+83 -9) 📝 `crates/resolver/src/lookup_ip.rs` (+2 -4) _...and 12 more files_ </details> ### 📄 Description I've taken an initial stab at cleaning up the DNSSEC validation and move to associating a Proof to each record. This differs a little bit from what was discussed in #1708 as I think this might be the best option. This adds a `Proof` enum that has the `Secure`, `Bogus`, `Insecure`, and `Indeterminate` as members. Once validated it associates that proof to the `Record`, there's more cleanup here as we only support `Secure` records being returned at the moment, and even though we can detect `Bogus`, it's returned as an `Error` right now, which I think we decided we want to move away from. I still need to add the `Insecure` path, but before I do that I wanted to see if anyone wanted to offer early feedback. Also, I want to reduce more cloning. I was able to remove quite a bit that was still there from before async/await was finalized. I think there's more yet that can be done. Fixes: #1708 Fixes: #2095 Fixes: #1650 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>