[GH-ISSUE #152] NSEC validation failing in nightly #368

New issue

Closed

opened 2026-03-15 22:10:52 +03:00 by kerem · 3 comments

kerem commented

2026-03-15 22:10:52 +03:00

Owner

Originally created by @bluejekyll on GitHub (Jun 24, 2017).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/152

There is something incorrect in the trust-dns-server authority. NSEC validation of publicly signed records functions properly.

cargo test test_nsec_query_example_nonet

which relies on the trust-dns-server Authority fails, while

cargo test test_nsec_query_example -- --ignored

which tests public records, passes

Regression on nightly

Ok, had a minute to track down the nightly version that broke this.

repro with:

rustup run nightly-2017-06-20 cargo test test_nsec_query_example_nonet

Current understanding of issue

This appears to be something in the Authority signing logic
It only affects NSEC records for some reason, and not signatures of other record types
It does not appear to be related to OpenSSL or Ring as both show the same issue, so it may not be signing issue
- I need to create more tests to validate the signing of the NSEC record type and work up from there to disqualify that

Originally created by @bluejekyll on GitHub (Jun 24, 2017). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/152 There is something incorrect in the trust-dns-server authority. NSEC validation of publicly signed records functions properly. ```console cargo test test_nsec_query_example_nonet ``` which relies on the trust-dns-server Authority fails, while ```console cargo test test_nsec_query_example -- --ignored ``` which tests public records, passes ---- ## Regression on nightly Ok, had a minute to track down the nightly version that broke this. repro with: ```console rustup run nightly-2017-06-20 cargo test test_nsec_query_example_nonet ``` ---- ## Current understanding of issue * This appears to be something in the `Authority` signing logic * It only affects NSEC records for some reason, and not signatures of other record types * It does not appear to be related to OpenSSL or Ring as both show the same issue, so it may not be signing issue * I need to create more tests to validate the signing of the NSEC record type and work up from there to disqualify that

kerem

2026-03-15 22:10:52 +03:00

closed this issue
added the
bug
label

kerem commented

2026-03-15 22:11:08 +03:00

Author

Owner

@bluejekyll commented on GitHub (Jun 25, 2017):

Possible root cause: https://github.com/rust-lang/rust/pull/39409

@bluejekyll commented on GitHub (Jun 25, 2017): Possible root cause: https://github.com/rust-lang/rust/pull/39409

kerem commented

2026-03-15 22:11:13 +03:00

Author

Owner

@bluejekyll commented on GitHub (Jun 28, 2017):

the related bug was closed. just need valid test run before closing this: https://github.com/rust-lang/rust/issues/42903

@bluejekyll commented on GitHub (Jun 28, 2017): the related bug was closed. just need valid test run before closing this: https://github.com/rust-lang/rust/issues/42903

kerem commented

2026-03-15 22:11:18 +03:00

Author

Owner

@bluejekyll commented on GitHub (Jun 29, 2017):

🎉 fixed!

@bluejekyll commented on GitHub (Jun 29, 2017): 🎉 fixed!

kerem referenced this issue

2026-03-15 22:40:42 +03:00

[GH-ISSUE #368] Add alternative default configs for different public resolvers #466