[PR #3422] Store proofs per-rrset #3833

New issue

Open

opened 2026-03-16 12:05:07 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 12:05:07 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/3422
Author: @marcus0x62
Created: 12/31/2025
Status: 🔄 Open

Base: main ← Head: one-proof-per-rrset

📝 Commits (10+)

ccb355b proto: break DS validation loop
cc3395e proto: rename ProofErrorKind::DsResponseNsec to DsResponseInsecure
7af0423 proto: simplify find_ds_records
0a766cb proto: remove verify_rrset
e24ce22 proto: remove Rrset in dnssec handle
b775a16 proto: clean up verify_rrsets
57aa8e6 resolver: simplify DnsResponse construction in DnssecDnsHandle
54c7482 proto: move RrsetProof to proto::rr
6d28473 proto: operate on RecordSets in verify_rrsets
7b450b3 test: add all DNSKEY records to trust anchor setup in named tests

📊 Changes

7 files changed (+868 additions, -539 deletions)

View changed files

📝 bin/tests/integration/named_test_rsa_dnssec.rs (+35 -12)
📝 crates/net/src/dnssec/error.rs (+3 -2)
📝 crates/net/src/dnssec/mod.rs (+634 -492)
📝 crates/net/src/dnssec/nsec3.rs (+46 -15)
📝 crates/proto/src/rr/mod.rs (+2 -2)
📝 crates/proto/src/rr/rr_set.rs (+141 -0)
📝 crates/resolver/src/recursor/handle.rs (+7 -16)

📄 Description

TODO

Use RecordSet in verify_nsec1 and verify_nsec3
Pass RrsetProofs back to client for overall message validation
Test coverage
Reword commits to reflect crate name changes

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/3422 **Author:** [@marcus0x62](https://github.com/marcus0x62) **Created:** 12/31/2025 **Status:** 🔄 Open **Base:** `main` ← **Head:** `one-proof-per-rrset` --- ### 📝 Commits (10+) - [`ccb355b`](https://github.com/hickory-dns/hickory-dns/commit/ccb355b195b7641cff71c088ae284db54fb846a9) proto: break DS validation loop - [`cc3395e`](https://github.com/hickory-dns/hickory-dns/commit/cc3395ec05974843a600305fd648b8a36268396b) proto: rename ProofErrorKind::DsResponseNsec to DsResponseInsecure - [`7af0423`](https://github.com/hickory-dns/hickory-dns/commit/7af04238eca1fb4179a7a7706744a318c3fae82c) proto: simplify find_ds_records - [`0a766cb`](https://github.com/hickory-dns/hickory-dns/commit/0a766cbb40371358a1a74103e211087228c5b878) proto: remove verify_rrset - [`e24ce22`](https://github.com/hickory-dns/hickory-dns/commit/e24ce2260108a9294939bac0aeba74ddacb69835) proto: remove Rrset in dnssec handle - [`b775a16`](https://github.com/hickory-dns/hickory-dns/commit/b775a16d25028e1609b77733b126787b50ecee40) proto: clean up verify_rrsets - [`57aa8e6`](https://github.com/hickory-dns/hickory-dns/commit/57aa8e6c9b4cc5d2aa53e1cf12a9afec835b4457) resolver: simplify DnsResponse construction in DnssecDnsHandle - [`54c7482`](https://github.com/hickory-dns/hickory-dns/commit/54c748292d909cff6e229266c65ff21c319cf963) proto: move RrsetProof to proto::rr - [`6d28473`](https://github.com/hickory-dns/hickory-dns/commit/6d284731382cdea00caab8b4d1bd190687ee06c5) proto: operate on RecordSets in verify_rrsets - [`7b450b3`](https://github.com/hickory-dns/hickory-dns/commit/7b450b3531075947909a8444ddcc687c415c41e4) test: add all DNSKEY records to trust anchor setup in named tests ### 📊 Changes **7 files changed** (+868 additions, -539 deletions) <details> <summary>View changed files</summary> 📝 `bin/tests/integration/named_test_rsa_dnssec.rs` (+35 -12) 📝 `crates/net/src/dnssec/error.rs` (+3 -2) 📝 `crates/net/src/dnssec/mod.rs` (+634 -492) 📝 `crates/net/src/dnssec/nsec3.rs` (+46 -15) 📝 `crates/proto/src/rr/mod.rs` (+2 -2) 📝 `crates/proto/src/rr/rr_set.rs` (+141 -0) 📝 `crates/resolver/src/recursor/handle.rs` (+7 -16) </details> ### 📄 Description TODO - [ ] Use RecordSet in verify_nsec1 and verify_nsec3 - [ ] Pass RrsetProofs back to client for overall message validation - [ ] Test coverage - [ ] Reword commits to reflect crate name changes --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>