[PR #3351] [MERGED] Cache DNSSEC validations #3767

New issue

Closed

opened 2026-03-16 12:01:35 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 12:01:35 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/3351
Author: @marcus0x62
Created: 11/16/2025
Status: ✅ Merged
Merged: 11/20/2025
Merged by: @marcus0x62

Base: main ← Head: dnssec-validation-caching

📝 Commits (4)

65a5580 proto: introduce RrsetVerificationContext in dnssec handle
2135436 proto: introduce RrsetProof in dnssec handle
79ad7fc proto: Hash implementation for OPT rdata type
8641864 proto: cache DNSSEC validations

📊 Changes

13 files changed (+507 additions, -61 deletions)

View changed files

📝 Cargo.lock (+2 -0)
📝 conformance/Cargo.lock (+68 -4)
📝 crates/proto/Cargo.toml (+3 -1)
📝 crates/proto/src/dnssec/handle.rs (+250 -41)
📝 crates/proto/src/dnssec/rdata/mod.rs (+1 -1)
📝 crates/proto/src/dnssec/supported_algorithm.rs (+1 -1)
📝 crates/proto/src/rr/rdata/opt.rs (+88 -5)
📝 crates/proto/src/rr/record_data.rs (+1 -1)
📝 crates/recursor/src/lib.rs (+3 -0)
📝 crates/recursor/src/recursor.rs (+1 -0)
📝 crates/recursor/src/recursor_dns_handle.rs (+21 -7)
📝 crates/server/src/store/recursor.rs (+4 -0)
📝 fuzz/Cargo.lock (+64 -0)

📄 Description

This adds a caching layer to the DNSSEC validation code to store the result of Rrset validation against DNSKEYs to reduce CPU load of repeated intermediate validations.

Related issue: #2294

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/3351 **Author:** [@marcus0x62](https://github.com/marcus0x62) **Created:** 11/16/2025 **Status:** ✅ Merged **Merged:** 11/20/2025 **Merged by:** [@marcus0x62](https://github.com/marcus0x62) **Base:** `main` ← **Head:** `dnssec-validation-caching` --- ### 📝 Commits (4) - [`65a5580`](https://github.com/hickory-dns/hickory-dns/commit/65a5580e82741c01ee7fec589889778c7b12fe96) proto: introduce RrsetVerificationContext in dnssec handle - [`2135436`](https://github.com/hickory-dns/hickory-dns/commit/21354362ca31de203104df3073d5f1fe920a42e5) proto: introduce RrsetProof in dnssec handle - [`79ad7fc`](https://github.com/hickory-dns/hickory-dns/commit/79ad7fcaebc859ac3435a9c5c3f0f14e3ae157cc) proto: Hash implementation for OPT rdata type - [`8641864`](https://github.com/hickory-dns/hickory-dns/commit/864186493fe5daa7fdaa2d8a42b9fe2c19b4b0be) proto: cache DNSSEC validations ### 📊 Changes **13 files changed** (+507 additions, -61 deletions) <details> <summary>View changed files</summary> 📝 `Cargo.lock` (+2 -0) 📝 `conformance/Cargo.lock` (+68 -4) 📝 `crates/proto/Cargo.toml` (+3 -1) 📝 `crates/proto/src/dnssec/handle.rs` (+250 -41) 📝 `crates/proto/src/dnssec/rdata/mod.rs` (+1 -1) 📝 `crates/proto/src/dnssec/supported_algorithm.rs` (+1 -1) 📝 `crates/proto/src/rr/rdata/opt.rs` (+88 -5) 📝 `crates/proto/src/rr/record_data.rs` (+1 -1) 📝 `crates/recursor/src/lib.rs` (+3 -0) 📝 `crates/recursor/src/recursor.rs` (+1 -0) 📝 `crates/recursor/src/recursor_dns_handle.rs` (+21 -7) 📝 `crates/server/src/store/recursor.rs` (+4 -0) 📝 `fuzz/Cargo.lock` (+64 -0) </details> ### 📄 Description This adds a caching layer to the DNSSEC validation code to store the result of Rrset validation against DNSKEYs to reduce CPU load of repeated intermediate validations. Related issue: #2294 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>