[PR #2253] [MERGED] add DNSSEC validation to the recursive resolver #2905

New issue

Closed

opened 2026-03-16 11:14:42 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:14:42 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/2253
Author: @japaric
Created: 6/20/2024
Status: ✅ Merged
Merged: 7/3/2024
Merged by: @djc

Base: main ← Head: ja-validating-recursor

📝 Commits (10+)

e6186f2 move is_subzone to the root of the recursor crate
adefc71 refactor caching a response into its own function
030ef34 move maybe_strip_dnssec_records into the root of the recursor crate
61438db move core resolution logic into its own module
fab7aed introduce DnssecPolicy
c6988c3 impl DNSSEC validation with static key
352adb0 switch TOML library from basic-toml to toml
f33d760 expose DnssecPolicy in RecursorConfig
3c46b51 set the AD flag when DNSSEC validation succeeds
65a96f1 have DnssecDnsHandle constructor take an Arc

📊 Changes

18 files changed (+844 additions, -448 deletions)

View changed files

📝 Cargo.lock (+53 -10)
📝 Cargo.toml (+1 -1)
📝 bin/tests/named_test_rsa_dnssec.rs (+7 -2)
📝 conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/secure.rs (+0 -2)
📝 conformance/packages/dns-test/src/templates/hickory.resolver.toml.jinja (+1 -2)
📝 crates/client/src/client/async_secure_client.rs (+3 -2)
📝 crates/proto/src/xfer/dnssec_dns_handle.rs (+3 -3)
📝 crates/recursor/src/lib.rs (+182 -0)
📝 crates/recursor/src/recursor.rs (+156 -416)
➕ crates/recursor/src/recursor_dns_handle.rs (+311 -0)
📝 crates/server/Cargo.toml (+2 -2)
📝 crates/server/src/authority/authority_object.rs (+5 -0)
📝 crates/server/src/authority/catalog.rs (+2 -0)
📝 crates/server/src/config/mod.rs (+1 -1)
📝 crates/server/src/error/config_error.rs (+1 -1)
📝 crates/server/src/store/recursor/authority.rs (+11 -3)
📝 crates/server/src/store/recursor/config.rs (+104 -2)
📝 tests/integration-tests/tests/dnssec_client_handle_tests.rs (+1 -1)

📄 Description

this is an initial implementation of DNSSEC validation that maximally reuses the existing DnssecDnsHandle logic.

it passes the "happy path" conformance tests but there's more work to be done to pass the tests that exercise the failure modes. namely, fixing the bug reported in #2252 . also, handling the CD (Checking Disabled) bit has not yet been implemented

~~this PR depends on #2245 so I have set that PR's branch as the base for this PR.~~

~~this PR depends on PRs #2257 , #2258 and #2268~~ all those PRs have been merged

to avoid this being merged into the wrong branch I'm opening this as a draft PR but it is ready for review this is now ready to be merged

closes #2194
closes #2234

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/2253 **Author:** [@japaric](https://github.com/japaric) **Created:** 6/20/2024 **Status:** ✅ Merged **Merged:** 7/3/2024 **Merged by:** [@djc](https://github.com/djc) **Base:** `main` ← **Head:** `ja-validating-recursor` --- ### 📝 Commits (10+) - [`e6186f2`](https://github.com/hickory-dns/hickory-dns/commit/e6186f2b0e8fbd0d421f7fe092d9971f4db6c1c9) move is_subzone to the root of the recursor crate - [`adefc71`](https://github.com/hickory-dns/hickory-dns/commit/adefc716b4e847a1ac8a855fbc88a75c206593e4) refactor caching a response into its own function - [`030ef34`](https://github.com/hickory-dns/hickory-dns/commit/030ef34858ab13b53eb8498f254ff2023b84d992) move maybe_strip_dnssec_records into the root of the recursor crate - [`61438db`](https://github.com/hickory-dns/hickory-dns/commit/61438db038e8df98970aa7f3c311f271fe7e90ce) move core resolution logic into its own module - [`fab7aed`](https://github.com/hickory-dns/hickory-dns/commit/fab7aed36f8caad5eb0a87b7421aed83b3406185) introduce DnssecPolicy - [`c6988c3`](https://github.com/hickory-dns/hickory-dns/commit/c6988c322478d1f873c0b62709950feaaa67cddb) impl DNSSEC validation with static key - [`352adb0`](https://github.com/hickory-dns/hickory-dns/commit/352adb01fd96588933ac31a7330bb07f2aeae292) switch TOML library from `basic-toml` to `toml` - [`f33d760`](https://github.com/hickory-dns/hickory-dns/commit/f33d76048d9244f9f60bc366609c0f47f0ee4c9b) expose DnssecPolicy in RecursorConfig - [`3c46b51`](https://github.com/hickory-dns/hickory-dns/commit/3c46b51e4e76cfdabbefa78282ac5e753281645b) set the AD flag when DNSSEC validation succeeds - [`65a96f1`](https://github.com/hickory-dns/hickory-dns/commit/65a96f1c078bf972b7c5a6e839d2f77622da74a1) have DnssecDnsHandle constructor take an Arc<TrustAnchor> ### 📊 Changes **18 files changed** (+844 additions, -448 deletions) <details> <summary>View changed files</summary> 📝 `Cargo.lock` (+53 -10) 📝 `Cargo.toml` (+1 -1) 📝 `bin/tests/named_test_rsa_dnssec.rs` (+7 -2) 📝 `conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/secure.rs` (+0 -2) 📝 `conformance/packages/dns-test/src/templates/hickory.resolver.toml.jinja` (+1 -2) 📝 `crates/client/src/client/async_secure_client.rs` (+3 -2) 📝 `crates/proto/src/xfer/dnssec_dns_handle.rs` (+3 -3) 📝 `crates/recursor/src/lib.rs` (+182 -0) 📝 `crates/recursor/src/recursor.rs` (+156 -416) ➕ `crates/recursor/src/recursor_dns_handle.rs` (+311 -0) 📝 `crates/server/Cargo.toml` (+2 -2) 📝 `crates/server/src/authority/authority_object.rs` (+5 -0) 📝 `crates/server/src/authority/catalog.rs` (+2 -0) 📝 `crates/server/src/config/mod.rs` (+1 -1) 📝 `crates/server/src/error/config_error.rs` (+1 -1) 📝 `crates/server/src/store/recursor/authority.rs` (+11 -3) 📝 `crates/server/src/store/recursor/config.rs` (+104 -2) 📝 `tests/integration-tests/tests/dnssec_client_handle_tests.rs` (+1 -1) </details> ### 📄 Description this is an initial implementation of DNSSEC validation that maximally reuses the existing `DnssecDnsHandle` logic. it passes the "happy path" conformance tests but there's more work to be done to pass the tests that exercise the failure modes. namely, fixing the bug reported in #2252 . also, handling the CD (Checking Disabled) bit has not yet been implemented ~~this PR depends on #2245 so I have set that PR's branch as the base for this PR.~~ ~~this PR depends on PRs #2257 , #2258 and #2268~~ all those PRs have been merged ~~to avoid this being merged into the wrong branch I'm opening this as a *draft PR* but **it is ready for review**~~ this is now ready to be merged closes #2194 closes #2234 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>