[PR #2845] [MERGED] Fix validating forwarder #3364

New issue

Closed

opened 2026-03-16 11:39:34 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:39:34 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/2845
Author: @divergentdave
Created: 3/13/2025
Status: ✅ Merged
Merged: 3/14/2025
Merged by: @djc

Base: main ← Head: david/validating-forwarder

📝 Commits (8)

2174c0f Override can_validate_dnssec() in ForwardAuthority
074e294 Adopt structured logging
4d2837d Add integration tests with SOA records
d21a4ac Fix setup of validate=false tests
da3d8fa Default implementation of dnssec_summary()
f6a7dab Return REFUSED instead of empty response upon RD=0
de9ca41 Add conformance test using NSEC
bf9ca7d Add test with bogus NSEC3 response

📊 Changes

8 files changed (+275 additions, -80 deletions)

View changed files

📝 conformance/packages/conformance-tests/src/forwarder/dnssec/scenarios.rs (+42 -2)
📝 conformance/packages/conformance-tests/src/forwarder/dnssec/scenarios/bogus.rs (+73 -4)
📝 crates/server/src/authority/auth_lookup.rs (+0 -22)
📝 crates/server/src/authority/authority_object.rs (+23 -1)
📝 crates/server/src/authority/catalog.rs (+14 -10)
📝 crates/server/src/store/forwarder/authority.rs (+5 -0)
📝 crates/server/src/store/recursor/authority.rs (+2 -26)
📝 tests/integration-tests/tests/integration/validating_forwarder_tests.rs (+116 -15)

📄 Description

This overrides can_validate_dnssec() on ForwardAuthority, adds a default implementation of dnssec_summary() on LookupObject, and makes the recursor and forwarder return REFUSED to queries with RD=0. Some additional tests are added, both in the integration tests and conformance tests. This fixes #2428. There may be additional room for hardening the validating forwarder, but I think this addresses the regression from 0.24.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/2845 **Author:** [@divergentdave](https://github.com/divergentdave) **Created:** 3/13/2025 **Status:** ✅ Merged **Merged:** 3/14/2025 **Merged by:** [@djc](https://github.com/djc) **Base:** `main` ← **Head:** `david/validating-forwarder` --- ### 📝 Commits (8) - [`2174c0f`](https://github.com/hickory-dns/hickory-dns/commit/2174c0ff3721057cd3a3ad927e29c307249793c1) Override can_validate_dnssec() in ForwardAuthority - [`074e294`](https://github.com/hickory-dns/hickory-dns/commit/074e29426a2f9d81623c898b53c23ab3ebd3c781) Adopt structured logging - [`4d2837d`](https://github.com/hickory-dns/hickory-dns/commit/4d2837df6c8ca489db00e3e4a8d5d923649573cf) Add integration tests with SOA records - [`d21a4ac`](https://github.com/hickory-dns/hickory-dns/commit/d21a4ac4425b6451211817e568763292996b7b57) Fix setup of validate=false tests - [`da3d8fa`](https://github.com/hickory-dns/hickory-dns/commit/da3d8fa1e2c086fdb2b63260e940123169404e5d) Default implementation of dnssec_summary() - [`f6a7dab`](https://github.com/hickory-dns/hickory-dns/commit/f6a7daba3037c1513a8cb60ee4917f6496abaa9b) Return REFUSED instead of empty response upon RD=0 - [`de9ca41`](https://github.com/hickory-dns/hickory-dns/commit/de9ca4158375ffe2f33cff16b3a531554d73a236) Add conformance test using NSEC - [`bf9ca7d`](https://github.com/hickory-dns/hickory-dns/commit/bf9ca7da7a0975a2160eae04bd070e2a4ec04f1d) Add test with bogus NSEC3 response ### 📊 Changes **8 files changed** (+275 additions, -80 deletions) <details> <summary>View changed files</summary> 📝 `conformance/packages/conformance-tests/src/forwarder/dnssec/scenarios.rs` (+42 -2) 📝 `conformance/packages/conformance-tests/src/forwarder/dnssec/scenarios/bogus.rs` (+73 -4) 📝 `crates/server/src/authority/auth_lookup.rs` (+0 -22) 📝 `crates/server/src/authority/authority_object.rs` (+23 -1) 📝 `crates/server/src/authority/catalog.rs` (+14 -10) 📝 `crates/server/src/store/forwarder/authority.rs` (+5 -0) 📝 `crates/server/src/store/recursor/authority.rs` (+2 -26) 📝 `tests/integration-tests/tests/integration/validating_forwarder_tests.rs` (+116 -15) </details> ### 📄 Description This overrides `can_validate_dnssec()` on `ForwardAuthority`, adds a default implementation of `dnssec_summary()` on `LookupObject`, and makes the recursor and forwarder return `REFUSED` to queries with RD=0. Some additional tests are added, both in the integration tests and conformance tests. This fixes #2428. There may be additional room for hardening the validating forwarder, but I think this addresses the regression from 0.24. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>