[PR #3141] [MERGED] Fix validation of negative responses from insecure zones #3592

New issue

Closed

opened 2026-03-16 11:52:04 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:52:04 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/3141
Author: @divergentdave
Created: 7/21/2025
Status: ✅ Merged
Merged: 7/25/2025
Merged by: @djc

Base: main ← Head: david/dnssec-insecure-zone-negative-response

📝 Commits (7)

4b519ac Extract function to get SOA RR's name
d347c5d Simplify find_soa_name()
a18d011 Defer checking for presence of SOA
d068634 Remove obsolete TODO
fb49cb3 Attach check_nsec() to DnssecDnsHandle
282a0c9 Fold check_nsec() into verify_response()
b506dac Add check for insecure zone in check_nsec()

📊 Changes

2 files changed (+106 additions, -120 deletions)

View changed files

📝 conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/no_soa.rs (+0 -1)
📝 crates/proto/src/dnssec/dnssec_dns_handle/mod.rs (+106 -119)

📄 Description

This PR replicates the find_ds_records() insecure zone check on the negative response code path. This closes #3128.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/3141 **Author:** [@divergentdave](https://github.com/divergentdave) **Created:** 7/21/2025 **Status:** ✅ Merged **Merged:** 7/25/2025 **Merged by:** [@djc](https://github.com/djc) **Base:** `main` ← **Head:** `david/dnssec-insecure-zone-negative-response` --- ### 📝 Commits (7) - [`4b519ac`](https://github.com/hickory-dns/hickory-dns/commit/4b519ac33c84792a08f40687991316bcec9e494c) Extract function to get SOA RR's name - [`d347c5d`](https://github.com/hickory-dns/hickory-dns/commit/d347c5d0b135a75d6ae36783f4a4a1eca6e4bc07) Simplify find_soa_name() - [`a18d011`](https://github.com/hickory-dns/hickory-dns/commit/a18d011cf5203fe15b256a089b52fc6e1853ba14) Defer checking for presence of SOA - [`d068634`](https://github.com/hickory-dns/hickory-dns/commit/d06863442a75ab4547471d40dccd43d0b34a7a80) Remove obsolete TODO - [`fb49cb3`](https://github.com/hickory-dns/hickory-dns/commit/fb49cb3c8c382ac5039743502a42d2d4e81f9b15) Attach check_nsec() to DnssecDnsHandle - [`282a0c9`](https://github.com/hickory-dns/hickory-dns/commit/282a0c9c6caaee036730307afed6e0eb91b8996a) Fold check_nsec() into verify_response() - [`b506dac`](https://github.com/hickory-dns/hickory-dns/commit/b506dac97eb7e6f61d8ec78f7ee95ded1581d970) Add check for insecure zone in check_nsec() ### 📊 Changes **2 files changed** (+106 additions, -120 deletions) <details> <summary>View changed files</summary> 📝 `conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/no_soa.rs` (+0 -1) 📝 `crates/proto/src/dnssec/dnssec_dns_handle/mod.rs` (+106 -119) </details> ### 📄 Description This PR replicates the `find_ds_records()` insecure zone check on the negative response code path. This closes #3128. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>