[PR #2899] [MERGED] NSEC3 Max Iterations Limits #3408

New issue

Closed

opened 2026-03-16 11:42:00 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:42:00 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/2899
Author: @marcus0x62
Created: 4/1/2025
Status: ✅ Merged
Merged: 5/20/2025
Merged by: @marcus0x62

Base: main ← Head: nsec3_max_iterations

📝 Commits (5)

0b45446 support setting nsec3 iteration count in dns-test
4e6a2a4 nsec3 hash iteration conformance tests
c7fd939 validate nsec/nsec3 records
82a0d5b propagate nsec errors to the catalog
7f850b5 enforce limits on nsec3 iteration values

📊 Changes

15 files changed (+514 additions, -24 deletions)

View changed files

📝 conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/insecure.rs (+3 -0)
📝 conformance/packages/conformance-tests/src/resolver/nsec.rs (+3 -0)
📝 conformance/packages/dns-test/src/zone_file/signer.rs (+29 -3)
📝 crates/proto/src/dnssec/dnssec_dns_handle/mod.rs (+79 -14)
📝 crates/proto/src/dnssec/dnssec_dns_handle/nsec3_validation.rs (+27 -0)
📝 crates/proto/src/error.rs (+8 -1)
📝 crates/recursor/src/lib.rs (+6 -0)
📝 crates/recursor/src/recursor.rs (+10 -2)
📝 crates/resolver/src/resolver.rs (+36 -2)
📝 crates/server/src/authority/catalog.rs (+45 -0)
📝 crates/server/src/store/recursor.rs (+16 -2)
📝 tests/e2e-tests/src/recursor.rs (+1 -0)
➕ tests/e2e-tests/src/recursor/dnssec.rs (+1 -0)
➕ tests/e2e-tests/src/recursor/dnssec/custom_nsec3_iterations.toml.jinja (+15 -0)
➕ tests/e2e-tests/src/recursor/dnssec/scenarios.rs (+235 -0)

📄 Description

Addresses #2626. This introduces configurable NSEC3 soft and hard iteration limits, as suggested in RFC 9276. The default values are 100 for the soft limit, and 500 for the hard limit. Both values are configurable.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/2899 **Author:** [@marcus0x62](https://github.com/marcus0x62) **Created:** 4/1/2025 **Status:** ✅ Merged **Merged:** 5/20/2025 **Merged by:** [@marcus0x62](https://github.com/marcus0x62) **Base:** `main` ← **Head:** `nsec3_max_iterations` --- ### 📝 Commits (5) - [`0b45446`](https://github.com/hickory-dns/hickory-dns/commit/0b4544669ac4c8ab85f8b7bd8c600580fc6ea746) support setting nsec3 iteration count in dns-test - [`4e6a2a4`](https://github.com/hickory-dns/hickory-dns/commit/4e6a2a4584e9a343e24dbac50d9a7d7c2238acd3) nsec3 hash iteration conformance tests - [`c7fd939`](https://github.com/hickory-dns/hickory-dns/commit/c7fd9391e8220d7ebd69aa9049c32d2a09ca7660) validate nsec/nsec3 records - [`82a0d5b`](https://github.com/hickory-dns/hickory-dns/commit/82a0d5b158a2c9acc7d1d58fa4104a0720d12a10) propagate nsec errors to the catalog - [`7f850b5`](https://github.com/hickory-dns/hickory-dns/commit/7f850b5fbdb80ba0cec95a23be984292e945e9e8) enforce limits on nsec3 iteration values ### 📊 Changes **15 files changed** (+514 additions, -24 deletions) <details> <summary>View changed files</summary> 📝 `conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/insecure.rs` (+3 -0) 📝 `conformance/packages/conformance-tests/src/resolver/nsec.rs` (+3 -0) 📝 `conformance/packages/dns-test/src/zone_file/signer.rs` (+29 -3) 📝 `crates/proto/src/dnssec/dnssec_dns_handle/mod.rs` (+79 -14) 📝 `crates/proto/src/dnssec/dnssec_dns_handle/nsec3_validation.rs` (+27 -0) 📝 `crates/proto/src/error.rs` (+8 -1) 📝 `crates/recursor/src/lib.rs` (+6 -0) 📝 `crates/recursor/src/recursor.rs` (+10 -2) 📝 `crates/resolver/src/resolver.rs` (+36 -2) 📝 `crates/server/src/authority/catalog.rs` (+45 -0) 📝 `crates/server/src/store/recursor.rs` (+16 -2) 📝 `tests/e2e-tests/src/recursor.rs` (+1 -0) ➕ `tests/e2e-tests/src/recursor/dnssec.rs` (+1 -0) ➕ `tests/e2e-tests/src/recursor/dnssec/custom_nsec3_iterations.toml.jinja` (+15 -0) ➕ `tests/e2e-tests/src/recursor/dnssec/scenarios.rs` (+235 -0) </details> ### 📄 Description Addresses #2626. This introduces configurable NSEC3 soft and hard iteration limits, as suggested in RFC 9276. The default values are 100 for the soft limit, and 500 for the hard limit. Both values are configurable. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>