[PR #2685] [MERGED] proto: hash lowercase names for DS and NSEC3 #3238

New issue

Closed

opened 2026-03-16 11:32:47 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:32:47 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/2685
Author: @divergentdave
Created: 12/18/2024
Status: ✅ Merged
Merged: 12/18/2024
Merged by: @djc

Base: main ← Head: david/dnssec-hash-lowercase

📝 Commits (2)

e5ea939 proto: hash lowercase name for DS
66c7ec3 proto: hash lowercase name for nsec3

📊 Changes

3 files changed (+40 additions, -4 deletions)

View changed files

📝 crates/proto/src/dnssec/nsec3.rs (+6 -2)
📝 crates/proto/src/dnssec/rdata/dnskey.rs (+1 -0)
📝 crates/proto/src/dnssec/rdata/ds.rs (+33 -2)

📄 Description

This changes hash calculations for DS and NSEC3 to be over lowercase names, and adds a couple unit tests to confirm.

RFC 4034 section 5.1.4 and RFC 5155 section 5 both say that the canonical form of the name is hashed. RFC 4034 section 6.2 and RFC 5155 section 5 both say the canonical form has all ASCII uppercase letters replaced by corresponding lowercase letters.

I ran into this while working on #2683. Signature validation is fine already, see github.com/hickory-dns/hickory-dns@ccf00381dc/crates/proto/src/dnssec/tbs.rs (L199).

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/2685 **Author:** [@divergentdave](https://github.com/divergentdave) **Created:** 12/18/2024 **Status:** ✅ Merged **Merged:** 12/18/2024 **Merged by:** [@djc](https://github.com/djc) **Base:** `main` ← **Head:** `david/dnssec-hash-lowercase` --- ### 📝 Commits (2) - [`e5ea939`](https://github.com/hickory-dns/hickory-dns/commit/e5ea939140708715395f81700a69d082efa9d5ea) proto: hash lowercase name for DS - [`66c7ec3`](https://github.com/hickory-dns/hickory-dns/commit/66c7ec390f7ff617bad0d1c0c4abcefd1b7302bd) proto: hash lowercase name for nsec3 ### 📊 Changes **3 files changed** (+40 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `crates/proto/src/dnssec/nsec3.rs` (+6 -2) 📝 `crates/proto/src/dnssec/rdata/dnskey.rs` (+1 -0) 📝 `crates/proto/src/dnssec/rdata/ds.rs` (+33 -2) </details> ### 📄 Description This changes hash calculations for DS and NSEC3 to be over lowercase names, and adds a couple unit tests to confirm. RFC 4034 section 5.1.4 and RFC 5155 section 5 both say that the canonical form of the name is hashed. RFC 4034 section 6.2 and RFC 5155 section 5 both say the canonical form has all ASCII uppercase letters replaced by corresponding lowercase letters. I ran into this while working on #2683. Signature validation is fine already, see https://github.com/hickory-dns/hickory-dns/blob/ccf00381dc768366e7423f1231890df0ac59b5e4/crates/proto/src/dnssec/tbs.rs#L199. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>