[PR #2286] [MERGED] answer with SERVFAIL when DNSSEC validation fails #2929

New issue

Closed

opened 2026-03-16 11:15:47 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:15:47 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/2286
Author: @japaric
Created: 7/5/2024
Status: ✅ Merged
Merged: 7/8/2024
Merged by: @djc

Base: main ← Head: ja-dnssec-servfail

📝 Commits (6)

5b69646 rename LookupOptions::{is_dnssec,dnssec}
714ee02 add Authority*::can_validate_dnssec
e74cbdb do not set the AD flag if the recursor is non-validating
c199736 conformance: remove delv assertions from some tests
13715d4 answer with SERVFAIL if validation fails
e64547b conformance: better classify SERVFAIL test

📊 Changes

12 files changed (+98 additions, -55 deletions)

View changed files

📝 bin/tests/server_harness/mod.rs (+1 -1)
📝 conformance/packages/conformance-tests/src/resolver/dnssec/rfc4035/section_3/section_3_2/section_3_2_2.rs (+20 -0)
📝 conformance/packages/conformance-tests/src/resolver/dnssec/scenarios.rs (+0 -1)
➖ conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/bogus.rs (+0 -29)
📝 conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/secure.rs (+1 -7)
📝 crates/recursor/src/recursor.rs (+6 -0)
📝 crates/server/src/authority/auth_lookup.rs (+1 -1)
📝 crates/server/src/authority/authority.rs (+14 -9)
📝 crates/server/src/authority/authority_object.rs (+7 -0)
📝 crates/server/src/authority/catalog.rs (+41 -4)
📝 crates/server/src/store/in_memory/authority.rs (+2 -2)
📝 crates/server/src/store/recursor/authority.rs (+5 -1)

📄 Description

and the CD bit was not set in the query, as per section 3.2.2 of RFC4053

closes #2283

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/2286 **Author:** [@japaric](https://github.com/japaric) **Created:** 7/5/2024 **Status:** ✅ Merged **Merged:** 7/8/2024 **Merged by:** [@djc](https://github.com/djc) **Base:** `main` ← **Head:** `ja-dnssec-servfail` --- ### 📝 Commits (6) - [`5b69646`](https://github.com/hickory-dns/hickory-dns/commit/5b696465e8080695885580c3e621e5cfa56e5fc7) rename LookupOptions::{is_dnssec,dnssec} - [`714ee02`](https://github.com/hickory-dns/hickory-dns/commit/714ee02319283d5312076722bf94481234161111) add Authority*::can_validate_dnssec - [`e74cbdb`](https://github.com/hickory-dns/hickory-dns/commit/e74cbdb1b3fd9f09297a746f4e18d5f5494d0b28) do not set the AD flag if the recursor is non-validating - [`c199736`](https://github.com/hickory-dns/hickory-dns/commit/c19973603315a4d717d786fb79493e7dda3ed050) conformance: remove `delv` assertions from some tests - [`13715d4`](https://github.com/hickory-dns/hickory-dns/commit/13715d444b62562e7e18614d65ab1002916c8536) answer with SERVFAIL if validation fails - [`e64547b`](https://github.com/hickory-dns/hickory-dns/commit/e64547be2962fd5f443ee0332320071183f0174d) conformance: better classify SERVFAIL test ### 📊 Changes **12 files changed** (+98 additions, -55 deletions) <details> <summary>View changed files</summary> 📝 `bin/tests/server_harness/mod.rs` (+1 -1) 📝 `conformance/packages/conformance-tests/src/resolver/dnssec/rfc4035/section_3/section_3_2/section_3_2_2.rs` (+20 -0) 📝 `conformance/packages/conformance-tests/src/resolver/dnssec/scenarios.rs` (+0 -1) ➖ `conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/bogus.rs` (+0 -29) 📝 `conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/secure.rs` (+1 -7) 📝 `crates/recursor/src/recursor.rs` (+6 -0) 📝 `crates/server/src/authority/auth_lookup.rs` (+1 -1) 📝 `crates/server/src/authority/authority.rs` (+14 -9) 📝 `crates/server/src/authority/authority_object.rs` (+7 -0) 📝 `crates/server/src/authority/catalog.rs` (+41 -4) 📝 `crates/server/src/store/in_memory/authority.rs` (+2 -2) 📝 `crates/server/src/store/recursor/authority.rs` (+5 -1) </details> ### 📄 Description and the CD bit was not set in the query, as per section 3.2.2 of RFC4053 closes #2283 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>