[PR #3343] [MERGED] recursive resolver opportunistic encryption nameserver state persistence #3762

New issue

Closed

opened 2026-03-16 12:01:18 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 12:01:18 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/3343
Author: @cpu
Created: 11/5/2025
Status: ✅ Merged
Merged: 11/19/2025
Merged by: @cpu

Base: main ← Head: cpu-9539-state_dev

📝 Commits (7)

f992912 server: fix copy-pasta config documentation
960bc7c resolver: enc transport state Instant -> SystemTime
0313b88 resolver: simplify name server transport state
56cfe0a resolver: fixup opp enc config duration serde
c1ea60f resolver: serde for opp enc transport state types
fef42c7 proto: move extra bounds to traits
a1c6b02 resolver: encrypted transport state load/periodic save

📊 Changes

14 files changed (+400 additions, -70 deletions)

View changed files

📝 crates/proto/src/dnssec/handle.rs (+5 -0)
📝 crates/proto/src/runtime.rs (+3 -3)
📝 crates/recursor/src/recursor.rs (+10 -1)
📝 crates/recursor/src/recursor_dns_handle.rs (+4 -0)
📝 crates/resolver/Cargo.toml (+3 -0)
📝 crates/resolver/src/config.rs (+35 -4)
📝 crates/resolver/src/lib.rs (+2 -0)
📝 crates/resolver/src/name_server.rs (+7 -7)
📝 crates/resolver/src/name_server_pool.rs (+219 -43)
📝 crates/server/Cargo.toml (+1 -1)
📝 crates/server/src/store/blocklist.rs (+1 -1)
📝 crates/server/src/store/forwarder.rs (+1 -1)
📝 crates/server/src/store/recursor.rs (+92 -7)
📝 tests/test-data/test_configs/example_recursor_opportunistic_enc.toml (+17 -2)

📄 Description

Provide a method for hickory server's running a recursive resolver external zone with opportunistic encryption enabled to load pre-existing state at zone handler creation time, and to periodically have updates to the state saved. Requires the hickory-resolver toml feature. Principally this is useful so a long-running recursor doesn't have to re-probe nameservers after a restart. It can remember its preexisting success/failures talking to nameservers with encrypted protocols and avoid using Do53 while reprobing.

Along the way, some pre-existing code had to be adjusted. Of main note:

The choice to use Instant instead of SystemTime in the NameServerTransportState was a mistake in retrospect, and since it's platform specific makes ser/der difficult. This branch switches to SystemTime to make that easier.
The (IpAddr, Protocol) tuple key for the state HashMap also plays poorly with ser/der since most formats (in particular TOML) require a String key for maps. Rather than hack around that in the ser/der code I revisited one of djc's earlier suggestions to use IpAddr as the key, and to add an intermediate struct with per-protocol fields. With the other refactoring we did this is a pretty nice solution (a.k.a lesson learned, djc is always right 😝). The number of protocols supported for opp. enc. encryption is fixed, so doesn't need to be part of the key anyway.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/3343 **Author:** [@cpu](https://github.com/cpu) **Created:** 11/5/2025 **Status:** ✅ Merged **Merged:** 11/19/2025 **Merged by:** [@cpu](https://github.com/cpu) **Base:** `main` ← **Head:** `cpu-9539-state_dev` --- ### 📝 Commits (7) - [`f992912`](https://github.com/hickory-dns/hickory-dns/commit/f99291289e82df4c46a3275e1a9a47471e8cd0de) server: fix copy-pasta config documentation - [`960bc7c`](https://github.com/hickory-dns/hickory-dns/commit/960bc7c56e733baf3f1dd3865ba271f9526f60a0) resolver: enc transport state Instant -> SystemTime - [`0313b88`](https://github.com/hickory-dns/hickory-dns/commit/0313b88380b5800e97b7fd516f87ca48dbac5258) resolver: simplify name server transport state - [`56cfe0a`](https://github.com/hickory-dns/hickory-dns/commit/56cfe0a9f8838d10a17c93089e13d94da2ccf7ec) resolver: fixup opp enc config duration serde - [`c1ea60f`](https://github.com/hickory-dns/hickory-dns/commit/c1ea60f8aa4ba607a9391bd41f9ace20a02195d8) resolver: serde for opp enc transport state types - [`fef42c7`](https://github.com/hickory-dns/hickory-dns/commit/fef42c79b162315fbe241ac1b9842c6825303c71) proto: move extra bounds to traits - [`a1c6b02`](https://github.com/hickory-dns/hickory-dns/commit/a1c6b0204763ba368085ce36dc20ad4fd145f656) resolver: encrypted transport state load/periodic save ### 📊 Changes **14 files changed** (+400 additions, -70 deletions) <details> <summary>View changed files</summary> 📝 `crates/proto/src/dnssec/handle.rs` (+5 -0) 📝 `crates/proto/src/runtime.rs` (+3 -3) 📝 `crates/recursor/src/recursor.rs` (+10 -1) 📝 `crates/recursor/src/recursor_dns_handle.rs` (+4 -0) 📝 `crates/resolver/Cargo.toml` (+3 -0) 📝 `crates/resolver/src/config.rs` (+35 -4) 📝 `crates/resolver/src/lib.rs` (+2 -0) 📝 `crates/resolver/src/name_server.rs` (+7 -7) 📝 `crates/resolver/src/name_server_pool.rs` (+219 -43) 📝 `crates/server/Cargo.toml` (+1 -1) 📝 `crates/server/src/store/blocklist.rs` (+1 -1) 📝 `crates/server/src/store/forwarder.rs` (+1 -1) 📝 `crates/server/src/store/recursor.rs` (+92 -7) 📝 `tests/test-data/test_configs/example_recursor_opportunistic_enc.toml` (+17 -2) </details> ### 📄 Description Provide a method for hickory server's running a recursive resolver external zone with opportunistic encryption enabled to load pre-existing state at zone handler creation time, and to periodically have updates to the state saved. Requires the hickory-resolver `toml` feature. Principally this is useful so a long-running recursor doesn't have to re-probe nameservers after a restart. It can remember its preexisting success/failures talking to nameservers with encrypted protocols and avoid using Do53 while reprobing. Along the way, some pre-existing code had to be adjusted. Of main note: 1. The choice to use `Instant` instead of `SystemTime` in the `NameServerTransportState` was a mistake in retrospect, and since it's platform specific makes ser/der difficult. This branch switches to `SystemTime` to make that easier. 2. The `(IpAddr, Protocol)` tuple key for the state `HashMap` also plays poorly with ser/der since most formats (in particular TOML) require a `String` key for maps. Rather than hack around that in the ser/der code I revisited one of djc's earlier suggestions to use `IpAddr` as the key, and to add an intermediate struct with per-protocol fields. With the other refactoring we did this is a pretty nice solution (a.k.a lesson learned, djc is always right :stuck_out_tongue_closed_eyes:). The number of protocols supported for opp. enc. encryption is fixed, so doesn't need to be part of the key anyway. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>