[PR #2546] [MERGED] Dnssec insecure delegations #3129

New issue

Closed

opened 2026-03-16 11:26:49 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:26:49 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/2546
Author: @marcus0x62
Created: 11/2/2024
Status: ✅ Merged
Merged: 11/19/2024
Merged by: @djc

Base: main ← Head: dnssec_insecure_delegations

📝 Commits (6)

0ca379e add support for NSEC3 opt-out to dns-test signer
d7a00ad NSEC3 opt-out support
75a6928 DNSSEC insecure delegation support
98c094b debug logs for nsec/nsec3 proof decisions
0cfdb5b fix and unignore existing insecure delegation tests
917a684 Add NSEC1 and NSEC3 opt-out tests to insecure tests scenarios

📊 Changes

9 files changed (+415 additions, -88 deletions)

View changed files

📝 conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/insecure.rs (+54 -25)
📝 conformance/packages/conformance-tests/src/resolver/nsec.rs (+12 -3)
📝 conformance/packages/dns-test/src/docker/bind.Dockerfile (+1 -0)
📝 conformance/packages/dns-test/src/docker/hickory.Dockerfile (+1 -0)
📝 conformance/packages/dns-test/src/docker/unbound.Dockerfile (+1 -0)
📝 conformance/packages/dns-test/src/zone_file/mod.rs (+7 -1)
📝 conformance/packages/dns-test/src/zone_file/signer.rs (+105 -24)
📝 crates/proto/src/xfer/dnssec_dns_handle/mod.rs (+57 -10)
📝 crates/proto/src/xfer/dnssec_dns_handle/nsec3_validation.rs (+177 -25)

📄 Description

This is hopefully the last change set to close out #2503. Originally, I thought the problem was isolated to a lack of support for NSEC3 opt-out proofs, but it looks like that in addition to that problem, insecure delegations are always being marked bogus by the current code, so there is a fix for that as well.

To facilitate testing these scenarios, there is also a commit for adding support to sign zones in dns-test with NSEC3 opt-out proofs, and one that adds debug-level logs to the nsec and nsec3 verification routines to indicate why a given proof is being returned as secure or bogus.

Making this a draft for now as there is some work to do on the nsec3 opt-out proof commit.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/2546 **Author:** [@marcus0x62](https://github.com/marcus0x62) **Created:** 11/2/2024 **Status:** ✅ Merged **Merged:** 11/19/2024 **Merged by:** [@djc](https://github.com/djc) **Base:** `main` ← **Head:** `dnssec_insecure_delegations` --- ### 📝 Commits (6) - [`0ca379e`](https://github.com/hickory-dns/hickory-dns/commit/0ca379e89f2f2ad8be92e7f7824b7efbae31d6c2) add support for NSEC3 opt-out to dns-test signer - [`d7a00ad`](https://github.com/hickory-dns/hickory-dns/commit/d7a00ad44fbf93ae8bad6a826f947eb8ee45ca5b) NSEC3 opt-out support - [`75a6928`](https://github.com/hickory-dns/hickory-dns/commit/75a6928fb10fc79766422bbb301c1d364a43bce7) DNSSEC insecure delegation support - [`98c094b`](https://github.com/hickory-dns/hickory-dns/commit/98c094b9c91ba8dfd7cfed4a2e62c7d835db10ae) debug logs for nsec/nsec3 proof decisions - [`0cfdb5b`](https://github.com/hickory-dns/hickory-dns/commit/0cfdb5b8d6abeceffb7aef1b0460d772e12e6593) fix and unignore existing insecure delegation tests - [`917a684`](https://github.com/hickory-dns/hickory-dns/commit/917a684a8ddcb2b417bbdc95d60e221e29ba6778) Add NSEC1 and NSEC3 opt-out tests to insecure tests scenarios ### 📊 Changes **9 files changed** (+415 additions, -88 deletions) <details> <summary>View changed files</summary> 📝 `conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/insecure.rs` (+54 -25) 📝 `conformance/packages/conformance-tests/src/resolver/nsec.rs` (+12 -3) 📝 `conformance/packages/dns-test/src/docker/bind.Dockerfile` (+1 -0) 📝 `conformance/packages/dns-test/src/docker/hickory.Dockerfile` (+1 -0) 📝 `conformance/packages/dns-test/src/docker/unbound.Dockerfile` (+1 -0) 📝 `conformance/packages/dns-test/src/zone_file/mod.rs` (+7 -1) 📝 `conformance/packages/dns-test/src/zone_file/signer.rs` (+105 -24) 📝 `crates/proto/src/xfer/dnssec_dns_handle/mod.rs` (+57 -10) 📝 `crates/proto/src/xfer/dnssec_dns_handle/nsec3_validation.rs` (+177 -25) </details> ### 📄 Description This is hopefully the last change set to close out #2503. Originally, I thought the problem was isolated to a lack of support for NSEC3 opt-out proofs, but it looks like that in addition to that problem, insecure delegations are always being marked bogus by the current code, so there is a fix for that as well. To facilitate testing these scenarios, there is also a commit for adding support to sign zones in dns-test with NSEC3 opt-out proofs, and one that adds debug-level logs to the nsec and nsec3 verification routines to indicate why a given proof is being returned as secure or bogus. Making this a draft for now as there is some work to do on the nsec3 opt-out proof commit. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>