[GH-ISSUE #1232] "non NoError responses should have been converted to an error above" panic when querying SOA of a non-existent domain #632

New issue

Closed

opened 2026-03-15 23:33:03 +03:00 by kerem · 3 comments

kerem commented

2026-03-15 23:33:03 +03:00

Owner

Originally created by @alexwl on GitHub (Oct 5, 2020).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/1232

Description
Panic when querying SOA record of a non-existent domain.

To Reproduce

[dependencies]
trust-dns-resolver = "0.20.0-alpha.2"

use trust_dns_resolver::config::*;
use trust_dns_resolver::Resolver;

fn main() {
    let mut resolver_config = ResolverConfig::new();
    resolver_config.add_name_server(NameServerConfig {
        socket_addr: "1.1.1.1:53".parse().unwrap(),
        protocol: Protocol::Udp,
        tls_dns_name: None,
    });
    let resolver = Resolver::new(resolver_config, ResolverOpts::default()).unwrap();
    let result = resolver.soa_lookup("vcszicl11k4eqnftc5qbw.com");
    println!("result: {:?}", result);
}

Error message:

thread 'main' panicked at 'internal error: entered unreachable code: non NoError responses should have been converted to an error above', /home/alexwl/.cargo/registry/src/github.com-1ecc6299db9ec823/trust-dns-resolver-0.20.0-alpha.2/src/lookup_state.rs:237:26

Version
0.20.0-alpha.2

Additional context
I guess, the response_code here:
github.com/bluejekyll/trust-dns@3ead8b1779/crates/resolver/src/lookup_state.rs (L220-L239)

is NXDomain, not NoError.

Originally created by @alexwl on GitHub (Oct 5, 2020). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/1232 **Description** Panic when querying SOA record of a non-existent domain. **To Reproduce** ```toml [dependencies] trust-dns-resolver = "0.20.0-alpha.2" ``` ```rust use trust_dns_resolver::config::*; use trust_dns_resolver::Resolver; fn main() { let mut resolver_config = ResolverConfig::new(); resolver_config.add_name_server(NameServerConfig { socket_addr: "1.1.1.1:53".parse().unwrap(), protocol: Protocol::Udp, tls_dns_name: None, }); let resolver = Resolver::new(resolver_config, ResolverOpts::default()).unwrap(); let result = resolver.soa_lookup("vcszicl11k4eqnftc5qbw.com"); println!("result: {:?}", result); } ``` Error message: ``` thread 'main' panicked at 'internal error: entered unreachable code: non NoError responses should have been converted to an error above', /home/alexwl/.cargo/registry/src/github.com-1ecc6299db9ec823/trust-dns-resolver-0.20.0-alpha.2/src/lookup_state.rs:237:26 ``` **Version** 0.20.0-alpha.2 **Additional context** I guess, the `response_code` here: https://github.com/bluejekyll/trust-dns/blob/3ead8b17790972993026f48263e472342ed34a0a/crates/resolver/src/lookup_state.rs#L220-L239 is `NXDomain`, not `NoError`.

kerem

2026-03-15 23:33:03 +03:00

closed this issue
added the
bug

crate:resolver
labels

kerem commented

2026-03-15 23:33:19 +03:00

Author

Owner

@bluejekyll commented on GitHub (Oct 5, 2020):

Thanks for the report. I was able to easily reproduce this.

Seems like responses are making back up the chain without being converted to errors in that case. I think we can just replace that unreachable with the nx_domain logic:

                Err(Self::handle_nxdomain(
                    is_dnssec,
                    false, /*tbd*/
                    query,
                    soa,
                    negative_ttl,
                    response_code,
                ))

I'm surprised the tests aren't catching this, probably need more negative tests.

@bluejekyll commented on GitHub (Oct 5, 2020): Thanks for the report. I was able to easily reproduce this. Seems like responses are making back up the chain without being converted to errors in that case. I think we can just replace that `unreachable` with the nx_domain logic: ```rust Err(Self::handle_nxdomain( is_dnssec, false, /*tbd*/ query, soa, negative_ttl, response_code, )) ``` I'm surprised the tests aren't catching this, probably need more negative tests.

kerem commented

2026-03-15 23:33:24 +03:00

Author

Owner

@bluejekyll commented on GitHub (Oct 5, 2020):

When querying for other types, this appears to function correctly. Not sure what is different about SOA requests.

@bluejekyll commented on GitHub (Oct 5, 2020): When querying for other types, this appears to function correctly. Not sure what is different about SOA requests.

kerem commented

2026-03-15 23:33:29 +03:00

Author

Owner

@bluejekyll commented on GitHub (Oct 22, 2020):

Fixed in #81cb3dbded

@bluejekyll commented on GitHub (Oct 22, 2020): Fixed in #81cb3dbdedc39f73e135154aa8d9b3df32c8db25

kerem referenced this issue

2026-03-16 02:13:32 +03:00

[PR #632] [MERGED] restrict udp responses to known hosts #1570