[PR #3103] [MERGED] Add negative tests for NSEC validation #3563

New issue

Closed

opened 2026-03-16 11:50:26 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:50:26 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/3103
Author: @divergentdave
Created: 7/8/2025
Status: ✅ Merged
Merged: 7/9/2025
Merged by: @divergentdave

Base: main ← Head: david/invalid-nsec-tests

📝 Commits (6)

fa756d5 Change variable names for BTreeSet
875d655 Include RRSIG in NSEC type bit maps
a3a0bf6 Extract common NSEC RR finalization to function
a32ab0c Exclude non-authoritative records from NSEC chain
6efe3f4 Extract reusable parts of invalid NSEC3 test
77ea3b1 Add negative tests of NSEC validation

📊 Changes

9 files changed (+957 additions, -195 deletions)

View changed files

📝 Cargo.lock (+23 -0)
📝 crates/proto/src/dnssec/rdata/nsec.rs (+5 -3)
📝 crates/server/src/store/in_memory/inner.rs (+39 -14)
📝 tests/integration-tests/Cargo.toml (+1 -0)
📝 tests/integration-tests/src/lib.rs (+67 -1)
➕ tests/integration-tests/src/mock_request_handler.rs (+132 -0)
📝 tests/integration-tests/tests/integration/invalid_nsec3_tests.rs (+18 -177)
➕ tests/integration-tests/tests/integration/invalid_nsec_tests.rs (+671 -0)
📝 tests/integration-tests/tests/integration/main.rs (+1 -0)

📄 Description

This adds negative tests for NSEC validation, parallel to the existing invalid_nsec3_tests module. As before, we have known issues both on the authoritative side and validation side when dealing with wildcard records. This PR also includes some easy fixes to make NSEC chains match examples from RFC 4035: including RRSIG in the type bit map, and excluding names with no authoritative records.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/3103 **Author:** [@divergentdave](https://github.com/divergentdave) **Created:** 7/8/2025 **Status:** ✅ Merged **Merged:** 7/9/2025 **Merged by:** [@divergentdave](https://github.com/divergentdave) **Base:** `main` ← **Head:** `david/invalid-nsec-tests` --- ### 📝 Commits (6) - [`fa756d5`](https://github.com/hickory-dns/hickory-dns/commit/fa756d5dd965b94ceba16fea8842f9557f4b01aa) Change variable names for BTreeSet - [`875d655`](https://github.com/hickory-dns/hickory-dns/commit/875d655760669ee76acc25d41877c15e14c047c3) Include RRSIG in NSEC type bit maps - [`a3a0bf6`](https://github.com/hickory-dns/hickory-dns/commit/a3a0bf69e16f306786b4f22622e8050debfde4d5) Extract common NSEC RR finalization to function - [`a32ab0c`](https://github.com/hickory-dns/hickory-dns/commit/a32ab0c24786fd57acb734f9c281f3269085abd6) Exclude non-authoritative records from NSEC chain - [`6efe3f4`](https://github.com/hickory-dns/hickory-dns/commit/6efe3f44b051416db4b8cf4715734139e28e8727) Extract reusable parts of invalid NSEC3 test - [`77ea3b1`](https://github.com/hickory-dns/hickory-dns/commit/77ea3b168e9f6f8c812aa56e0112b28eee613987) Add negative tests of NSEC validation ### 📊 Changes **9 files changed** (+957 additions, -195 deletions) <details> <summary>View changed files</summary> 📝 `Cargo.lock` (+23 -0) 📝 `crates/proto/src/dnssec/rdata/nsec.rs` (+5 -3) 📝 `crates/server/src/store/in_memory/inner.rs` (+39 -14) 📝 `tests/integration-tests/Cargo.toml` (+1 -0) 📝 `tests/integration-tests/src/lib.rs` (+67 -1) ➕ `tests/integration-tests/src/mock_request_handler.rs` (+132 -0) 📝 `tests/integration-tests/tests/integration/invalid_nsec3_tests.rs` (+18 -177) ➕ `tests/integration-tests/tests/integration/invalid_nsec_tests.rs` (+671 -0) 📝 `tests/integration-tests/tests/integration/main.rs` (+1 -0) </details> ### 📄 Description This adds negative tests for NSEC validation, parallel to the existing `invalid_nsec3_tests` module. As before, we have known issues both on the authoritative side and validation side when dealing with wildcard records. This PR also includes some easy fixes to make NSEC chains match examples from RFC 4035: including RRSIG in the type bit map, and excluding names with no authoritative records. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>