[PR #2782] [MERGED] Add negative test for NSEC3 validation #3310

New issue

Closed

opened 2026-03-16 11:36:51 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:36:51 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/2782
Author: @divergentdave
Created: 2/14/2025
Status: ✅ Merged
Merged: 2/25/2025
Merged by: @divergentdave

Base: main ← Head: david/ds-cover-test

📝 Commits (1)

1f3a08f Add negative test for NSEC3 validation

📊 Changes

6 files changed (+360 additions, -2 deletions)

View changed files

📝 conformance/packages/conformance-tests/src/resolver/dnssec/scenarios.rs (+1 -0)
➕ conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/nsec3.rs (+1 -0)
➕ conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/nsec3/does_not_cover/mod.rs (+76 -0)
➕ conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/nsec3/does_not_cover/server.py (+277 -0)
📝 conformance/packages/dns-test/src/docker/dnslib.Dockerfile (+4 -1)
📝 conformance/packages/dns-test/src/name_server.rs (+1 -1)

📄 Description

This adds a test case for #2774. It passes with the latest commit, and fails with older commits. The test adds a bunch of records to a zone and signs it, and then has a dnslib-based server pick one NSEC3 and RRSIG record pair to use with all NXDOMAIN responses. It then probes the resolver with a few queries and checks if it gets SERVFAIL back. (previously Hickory DNS would return NXDOMAIN)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/2782 **Author:** [@divergentdave](https://github.com/divergentdave) **Created:** 2/14/2025 **Status:** ✅ Merged **Merged:** 2/25/2025 **Merged by:** [@divergentdave](https://github.com/divergentdave) **Base:** `main` ← **Head:** `david/ds-cover-test` --- ### 📝 Commits (1) - [`1f3a08f`](https://github.com/hickory-dns/hickory-dns/commit/1f3a08f57df6f24af9a775eb6dce07d77a7c4785) Add negative test for NSEC3 validation ### 📊 Changes **6 files changed** (+360 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `conformance/packages/conformance-tests/src/resolver/dnssec/scenarios.rs` (+1 -0) ➕ `conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/nsec3.rs` (+1 -0) ➕ `conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/nsec3/does_not_cover/mod.rs` (+76 -0) ➕ `conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/nsec3/does_not_cover/server.py` (+277 -0) 📝 `conformance/packages/dns-test/src/docker/dnslib.Dockerfile` (+4 -1) 📝 `conformance/packages/dns-test/src/name_server.rs` (+1 -1) </details> ### 📄 Description This adds a test case for #2774. It passes with the latest commit, and fails with older commits. The test adds a bunch of records to a zone and signs it, and then has a dnslib-based server pick one NSEC3 and RRSIG record pair to use with all NXDOMAIN responses. It then probes the resolver with a few queries and checks if it gets SERVFAIL back. (previously Hickory DNS would return NXDOMAIN) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>