[PR #2937] [MERGED] Remove special handling for DS nonexistence #3433

New issue

Closed

opened 2026-03-16 11:43:21 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:43:21 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/2937
Author: @divergentdave
Created: 4/17/2025
Status: ✅ Merged
Merged: 4/25/2025
Merged by: @divergentdave

Base: main ← Head: david/ds-nonexistence-secure

📝 Commits (1)

98cd817 Remove special handling for DS nonexistence

📊 Changes

3 files changed (+33 additions, -33 deletions)

View changed files

📝 crates/proto/src/dnssec/dnssec_dns_handle/mod.rs (+27 -18)
📝 crates/proto/src/dnssec/dnssec_dns_handle/nsec3_validation.rs (+6 -14)
📝 tests/integration-tests/tests/integration/invalid_nsec3_tests.rs (+0 -1)

📄 Description

This fixes #2812. The NSEC and NSEC3 routines are changed to return "Secure" upon success regardless of the query type. Then fetch_ds_records() is updated to handle nonexistence responses appearing as either errors (for the insecure case) or as Ok(response) (for the secure case). Adding this branch revealed a hole in the validating forwarder, as one test started failing, so I changed the Insecure early return in check_nsec() to no longer fire on empty name server sections.

This is stacked on top of #2936 for now.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/2937 **Author:** [@divergentdave](https://github.com/divergentdave) **Created:** 4/17/2025 **Status:** ✅ Merged **Merged:** 4/25/2025 **Merged by:** [@divergentdave](https://github.com/divergentdave) **Base:** `main` ← **Head:** `david/ds-nonexistence-secure` --- ### 📝 Commits (1) - [`98cd817`](https://github.com/hickory-dns/hickory-dns/commit/98cd8175b8c07dd9c5a696512cb1d9ed5b2a65ac) Remove special handling for DS nonexistence ### 📊 Changes **3 files changed** (+33 additions, -33 deletions) <details> <summary>View changed files</summary> 📝 `crates/proto/src/dnssec/dnssec_dns_handle/mod.rs` (+27 -18) 📝 `crates/proto/src/dnssec/dnssec_dns_handle/nsec3_validation.rs` (+6 -14) 📝 `tests/integration-tests/tests/integration/invalid_nsec3_tests.rs` (+0 -1) </details> ### 📄 Description This fixes #2812. The NSEC and NSEC3 routines are changed to return "Secure" upon success regardless of the query type. Then `fetch_ds_records()` is updated to handle nonexistence responses appearing as either errors (for the insecure case) or as `Ok(response)` (for the secure case). Adding this branch revealed a hole in the validating forwarder, as one test started failing, so I changed the `Insecure` early return in `check_nsec()` to no longer fire on empty name server sections. This is stacked on top of #2936 for now. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>