[PR #2438] [MERGED] dnssec: report Insecure outcome as NOERROR+AD=0 #3042

New issue

Closed

opened 2026-03-16 11:22:02 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:22:02 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/2438
Author: @japaric
Created: 9/6/2024
Status: ✅ Merged
Merged: 9/10/2024
Merged by: @japaric

Base: main ← Head: ja-insecure-answer

📝 Commits (3)

8f4d55c server: report Insecure as NOERROR+AD=0
6f67c48 proto: treat unknown algorithms as Insecure
9fea3d7 proto: treat record as Insecure if all keys are Insecure

📊 Changes

8 files changed (+115 additions, -49 deletions)

View changed files

📝 conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/bogus.rs (+2 -10)
📝 crates/proto/src/rr/dnssec/proof.rs (+4 -0)
📝 crates/proto/src/xfer/dnssec_dns_handle.rs (+49 -13)
📝 crates/server/src/authority/authority_object.rs (+13 -2)
📝 crates/server/src/authority/catalog.rs (+17 -10)
📝 crates/server/src/authority/mod.rs (+1 -1)
📝 crates/server/src/store/recursor/authority.rs (+20 -10)
📝 tests/ede-dot-com/src/lib.rs (+9 -3)

📄 Description

fixes #2395

but there are still scenarios that hickory mis-clasifies as Bogus when they should be treated as Insecure. Deprecated algorithms, no DS and unsigned zones are among those scenarios. The last two are currently failing due to a NSEC logic bug ( #2435 )

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/2438 **Author:** [@japaric](https://github.com/japaric) **Created:** 9/6/2024 **Status:** ✅ Merged **Merged:** 9/10/2024 **Merged by:** [@japaric](https://github.com/japaric) **Base:** `main` ← **Head:** `ja-insecure-answer` --- ### 📝 Commits (3) - [`8f4d55c`](https://github.com/hickory-dns/hickory-dns/commit/8f4d55c54258ec0de3741d09adaf6c79f667339e) server: report Insecure as NOERROR+AD=0 - [`6f67c48`](https://github.com/hickory-dns/hickory-dns/commit/6f67c48894d34b328d68490e38e91ff6911b040c) proto: treat unknown algorithms as Insecure - [`9fea3d7`](https://github.com/hickory-dns/hickory-dns/commit/9fea3d7e1588e052cf77538c9290baef28ca5599) proto: treat record as Insecure if all keys are Insecure ### 📊 Changes **8 files changed** (+115 additions, -49 deletions) <details> <summary>View changed files</summary> 📝 `conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/bogus.rs` (+2 -10) 📝 `crates/proto/src/rr/dnssec/proof.rs` (+4 -0) 📝 `crates/proto/src/xfer/dnssec_dns_handle.rs` (+49 -13) 📝 `crates/server/src/authority/authority_object.rs` (+13 -2) 📝 `crates/server/src/authority/catalog.rs` (+17 -10) 📝 `crates/server/src/authority/mod.rs` (+1 -1) 📝 `crates/server/src/store/recursor/authority.rs` (+20 -10) 📝 `tests/ede-dot-com/src/lib.rs` (+9 -3) </details> ### 📄 Description fixes #2395 but there are still scenarios that hickory mis-clasifies as Bogus when they should be treated as Insecure. Deprecated algorithms, no DS and unsigned zones are among those scenarios. The last two are currently failing due to a NSEC logic bug ( #2435 ) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>