[PR #2196] [MERGED] recursor: respect DO bit in incoming queries #2872

New issue

Closed

opened 2026-03-16 11:12:48 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:12:48 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/2196
Author: @japaric
Created: 4/25/2024
Status: ✅ Merged
Merged: 5/11/2024
Merged by: @bluejekyll

Base: main ← Head: ja-recursor-respects-do

📝 Commits (5)

3b3f330 recursor: set DO in outgoing queries
7f24fcb recursor: preserve DNSSEC records
48a2531 recursor: honor DO bit in client's query
93bb8b6 make Recursor configurable via a "builder"
0ede6a5 expose security-aware setting in named.toml

📊 Changes

9 files changed (+185 additions, -45 deletions)

View changed files

📝 crates/proto/src/xfer/dns_handle.rs (+2 -1)
📝 crates/proto/src/xfer/dns_request.rs (+3 -0)
📝 crates/recursor/src/lib.rs (+5 -1)
📝 crates/recursor/src/recursor.rs (+153 -34)
📝 crates/recursor/src/recursor_pool.rs (+2 -2)
📝 crates/server/Cargo.toml (+1 -1)
📝 crates/server/src/store/recursor/authority.rs (+11 -4)
📝 crates/server/src/store/recursor/config.rs (+6 -0)
📝 util/src/bin/recurse.rs (+2 -2)

📄 Description

At the moment this implements the first half of RFC 4035, section 3.2.1: the DO bit is set in the queries the recursive resolver sends on behalf of the client. On the wire, I can see that the name servers it communicates with include extra DNSSEC records in their response to the resolver. However, the Recursor removes those extra DNSSEC records before answering the client. That stripping of DNSSEC records does the opposite of the second half of what the RFC dictates (when the DO bit is set).

AFAICT, the stripping of those DNSSEC records happens here. That function caches all the received records but only responds with the ones that exactly match the query and as DNSSEC records like RRSIG were not included in the original query it discards them.

I still have to figure out how to best avoid stripping so I'm leaving this as a draft PR for now.

P.S. I'm checking conformance with the tests in https://github.com/ferrous-systems/dnssec-tests/pull/53

cc #2193

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/2196 **Author:** [@japaric](https://github.com/japaric) **Created:** 4/25/2024 **Status:** ✅ Merged **Merged:** 5/11/2024 **Merged by:** [@bluejekyll](https://github.com/bluejekyll) **Base:** `main` ← **Head:** `ja-recursor-respects-do` --- ### 📝 Commits (5) - [`3b3f330`](https://github.com/hickory-dns/hickory-dns/commit/3b3f330380aa383ef81f98d8e1af534fd3a4e043) recursor: set DO in outgoing queries - [`7f24fcb`](https://github.com/hickory-dns/hickory-dns/commit/7f24fcb163720087cdf9ab645e00961f6d1a4a4b) recursor: preserve DNSSEC records - [`48a2531`](https://github.com/hickory-dns/hickory-dns/commit/48a2531781358bb33475cf4942edc0f4bba24ada) recursor: honor DO bit in client's query - [`93bb8b6`](https://github.com/hickory-dns/hickory-dns/commit/93bb8b6a85d6087e0e505c2dc9d874d41cca58cb) make Recursor configurable via a "builder" - [`0ede6a5`](https://github.com/hickory-dns/hickory-dns/commit/0ede6a567e7a501c91c05a26d1ec698affb2e5e6) expose security-aware setting in named.toml ### 📊 Changes **9 files changed** (+185 additions, -45 deletions) <details> <summary>View changed files</summary> 📝 `crates/proto/src/xfer/dns_handle.rs` (+2 -1) 📝 `crates/proto/src/xfer/dns_request.rs` (+3 -0) 📝 `crates/recursor/src/lib.rs` (+5 -1) 📝 `crates/recursor/src/recursor.rs` (+153 -34) 📝 `crates/recursor/src/recursor_pool.rs` (+2 -2) 📝 `crates/server/Cargo.toml` (+1 -1) 📝 `crates/server/src/store/recursor/authority.rs` (+11 -4) 📝 `crates/server/src/store/recursor/config.rs` (+6 -0) 📝 `util/src/bin/recurse.rs` (+2 -2) </details> ### 📄 Description At the moment this implements the first half of [RFC 4035, section 3.2.1](https://datatracker.ietf.org/doc/html/rfc4035#section-3.2.1): the DO bit is set in the queries the recursive resolver sends on behalf of the client. On the wire, I can see that the name servers it communicates with include extra DNSSEC records in their response to the resolver. However, the `Recursor` removes those extra DNSSEC records before answering the client. That stripping of DNSSEC records does the opposite of the second half of what the RFC dictates (when the DO bit is set). AFAICT, the stripping of those DNSSEC records happens [here](https://github.com/hickory-dns/hickory-dns/blob/6334a01430088ead8642cafaee592ec7bf49831f/crates/recursor/src/recursor.rs#L324). That function caches all the received records but only responds with the ones that *exactly* match the query and as DNSSEC records like RRSIG were not included in the original query it discards them. I still have to figure out how to best avoid stripping so I'm leaving this as a draft PR for now. P.S. I'm checking conformance with the tests in https://github.com/ferrous-systems/dnssec-tests/pull/53 cc #2193 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>