[PR #2392] [MERGED] DNSSEC validation fixes #3009

New issue

Closed

opened 2026-03-16 11:20:08 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:20:08 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/2392
Author: @japaric
Created: 8/29/2024
Status: ✅ Merged
Merged: 8/30/2024
Merged by: @japaric

Base: main ← Head: ja-verify-dnskey-rrsigs

📝 Commits (6)

3773e7f dns-test: add FQDN::push_label
ec314ce conformance: no RRSIG that covers DNSKEYs
de8b8fa validate DNSKEY's RRSIGs
f1b7fe1 conformance: move test into a new module
b84b0f3 conformance: test a different query
bd1d71a only use Secure DNSKEYs to validate records

📊 Changes

6 files changed (+185 additions, -20 deletions)

View changed files

📝 conformance/packages/conformance-tests/src/resolver/dnssec/scenarios.rs (+1 -0)
➕ conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/bogus.rs (+1 -0)
➕ conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/bogus/no_rrsig_dnskey.rs (+150 -0)
📝 conformance/packages/dns-test/src/fqdn.rs (+9 -0)
📝 crates/proto/src/xfer/dnssec_dns_handle.rs (+24 -14)
📝 tests/ede-dot-com/src/lib.rs (+0 -6)

📄 Description

this PR fixes two bugs in the DNSSEC validation logic.

the RRSIGs of a DNSKEY were not validated. meaning that a DNSKEY not covered by RRSIG records was accepted as secure.
not Secure DNSKEYs were being used to validate other records because their Proof status was not checked

regression tests have been added for both bugs

this fixes 6 test failures in the ede-dot-com test suite including the no-rrsig-dnskey case (it would be nice to merge #2385 to track those fixes in the code )

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/2392 **Author:** [@japaric](https://github.com/japaric) **Created:** 8/29/2024 **Status:** ✅ Merged **Merged:** 8/30/2024 **Merged by:** [@japaric](https://github.com/japaric) **Base:** `main` ← **Head:** `ja-verify-dnskey-rrsigs` --- ### 📝 Commits (6) - [`3773e7f`](https://github.com/hickory-dns/hickory-dns/commit/3773e7f6a19e96108f04077d019114892c412eb3) dns-test: add FQDN::push_label - [`ec314ce`](https://github.com/hickory-dns/hickory-dns/commit/ec314ce518f1737e5a763b5b9fe8f82b3acec639) conformance: no RRSIG that covers DNSKEYs - [`de8b8fa`](https://github.com/hickory-dns/hickory-dns/commit/de8b8fab110fd7041b33a722762b12f691956989) validate DNSKEY's RRSIGs - [`f1b7fe1`](https://github.com/hickory-dns/hickory-dns/commit/f1b7fe1cf4593540708901a4a83691909c45a1ef) conformance: move test into a new module - [`b84b0f3`](https://github.com/hickory-dns/hickory-dns/commit/b84b0f33b13ff2b0916392b02cc988396df44da6) conformance: test a different query - [`bd1d71a`](https://github.com/hickory-dns/hickory-dns/commit/bd1d71ab8415197b4d08b51a965bc73760038f11) only use Secure DNSKEYs to validate records ### 📊 Changes **6 files changed** (+185 additions, -20 deletions) <details> <summary>View changed files</summary> 📝 `conformance/packages/conformance-tests/src/resolver/dnssec/scenarios.rs` (+1 -0) ➕ `conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/bogus.rs` (+1 -0) ➕ `conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/bogus/no_rrsig_dnskey.rs` (+150 -0) 📝 `conformance/packages/dns-test/src/fqdn.rs` (+9 -0) 📝 `crates/proto/src/xfer/dnssec_dns_handle.rs` (+24 -14) 📝 `tests/ede-dot-com/src/lib.rs` (+0 -6) </details> ### 📄 Description this PR fixes two bugs in the DNSSEC validation logic. 1. the RRSIGs of a DNSKEY were not validated. meaning that a DNSKEY not covered by RRSIG records was accepted as secure. 2. not Secure DNSKEYs were being used to validate other records because their `Proof` status was not checked regression tests have been added for both bugs this fixes 6 test failures in the `ede-dot-com` test suite including the `no-rrsig-dnskey` case (it would be nice to merge #2385 to track those fixes in the code ) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>