[PR #2119] [MERGED] Bailiwick checking for the recursor #2822

New issue

Closed

opened 2026-03-16 11:10:05 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:10:05 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/2119
Author: @marcus0x62
Created: 12/27/2023
Status: ✅ Merged
Merged: 1/5/2024
Merged by: @bluejekyll

Base: main ← Head: bailiwick_checking

📝 Commits (4)

fab156c Basic bailiwick checking for the recursor
6d1da5c Change in_bailiwick function name to be more descriptive (is_subzone)
e73d6db Changed to doc comment
9163288 Refactor is_subzone to use Name::zone_of with additional checks for partially/fully qualified domains.

📊 Changes

1 file changed (+109 additions, -1 deletions)

View changed files

📝 crates/recursor/src/recursor.rs (+109 -1)

📄 Description

This PR improves cache poisoning resistance in the recursor by adding Bailiwick checking: for records returned from a remote resolver, the bailiwick check tests that the records are subordinate to the zone authority: example.com can return records for host.example.com, but host.otherdomain.com is out of bailiwick and rejected.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/2119 **Author:** [@marcus0x62](https://github.com/marcus0x62) **Created:** 12/27/2023 **Status:** ✅ Merged **Merged:** 1/5/2024 **Merged by:** [@bluejekyll](https://github.com/bluejekyll) **Base:** `main` ← **Head:** `bailiwick_checking` --- ### 📝 Commits (4) - [`fab156c`](https://github.com/hickory-dns/hickory-dns/commit/fab156c387f84424cc8394f1b87b95d46226a688) Basic bailiwick checking for the recursor - [`6d1da5c`](https://github.com/hickory-dns/hickory-dns/commit/6d1da5c5bfa5e884edc3ea5f3366e69a0eb69743) Change in_bailiwick function name to be more descriptive (is_subzone) - [`e73d6db`](https://github.com/hickory-dns/hickory-dns/commit/e73d6dbb638b2d29b5b4d61354cdbb2d5430f9b5) Changed to doc comment - [`9163288`](https://github.com/hickory-dns/hickory-dns/commit/91632887c44140fb92e2361ef57483f901e8db49) Refactor is_subzone to use Name::zone_of with additional checks for partially/fully qualified domains. ### 📊 Changes **1 file changed** (+109 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `crates/recursor/src/recursor.rs` (+109 -1) </details> ### 📄 Description This PR improves cache poisoning resistance in the recursor by adding Bailiwick checking: for records returned from a remote resolver, the bailiwick check tests that the records are subordinate to the zone authority: example.com can return records for host.example.com, but host.otherdomain.com is out of bailiwick and rejected. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>