[PR #2396] [MERGED] dnssec: validate DS records #3014

New issue

Closed

opened 2026-03-16 11:20:24 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:20:24 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/2396
Author: @japaric
Created: 8/30/2024
Status: ✅ Merged
Merged: 9/2/2024
Merged by: @japaric

Base: main ← Head: ja-validate-ds

📝 Commits (5)

15296ca conformance: add malformed DS tests
3b5127a reject DS records with unknown algorithms
008fb1e skip DS records whose algorithm does not match the DNSKEY's
aaa6870 check that key tag matches before using a DS record
8eed581 remove superfluous trace! log

📊 Changes

3 files changed (+170 additions, -4 deletions)

View changed files

📝 conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/bogus.rs (+139 -0)
📝 crates/proto/src/xfer/dnssec_dns_handle.rs (+31 -2)
📝 tests/ede-dot-com/src/lib.rs (+0 -2)

📄 Description

this PR ports 4 false positives scenarios from ede-dot-com into conformance-tests. Adds 3 DS checks to the DNSSEC validation code which fix all the newly added conformance tests.

Observably, this only fixes 2 ede-dot-com tests because the other 2 scenarios still fail due to #2395

~~this PR depends on #2392 so opening in draft state until that is merged~~

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/2396 **Author:** [@japaric](https://github.com/japaric) **Created:** 8/30/2024 **Status:** ✅ Merged **Merged:** 9/2/2024 **Merged by:** [@japaric](https://github.com/japaric) **Base:** `main` ← **Head:** `ja-validate-ds` --- ### 📝 Commits (5) - [`15296ca`](https://github.com/hickory-dns/hickory-dns/commit/15296ca9f86064acb09b21c8a45923a5d591288f) conformance: add malformed DS tests - [`3b5127a`](https://github.com/hickory-dns/hickory-dns/commit/3b5127ac250c22e7f0d951970a3fea263cebc58d) reject DS records with unknown algorithms - [`008fb1e`](https://github.com/hickory-dns/hickory-dns/commit/008fb1efb2db0f87aede71ee2c2f15c0fba9aaee) skip DS records whose algorithm does not match the DNSKEY's - [`aaa6870`](https://github.com/hickory-dns/hickory-dns/commit/aaa68708f0f3b4975923a5a1fba3965e8d508cbc) check that key tag matches before using a DS record - [`8eed581`](https://github.com/hickory-dns/hickory-dns/commit/8eed581e75876c62c53b16d3ef944b875bd3672e) remove superfluous `trace!` log ### 📊 Changes **3 files changed** (+170 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/bogus.rs` (+139 -0) 📝 `crates/proto/src/xfer/dnssec_dns_handle.rs` (+31 -2) 📝 `tests/ede-dot-com/src/lib.rs` (+0 -2) </details> ### 📄 Description this PR ports 4 false positives scenarios from `ede-dot-com` into `conformance-tests`. Adds 3 DS checks to the DNSSEC validation code which fix all the newly added conformance tests. Observably, this only fixes 2 `ede-dot-com` tests because the other 2 scenarios still fail due to #2395 ~~this PR depends on #2392 so opening in draft state until that is merged~~ --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>