[GH-ISSUE #2282] test what the AD should be set to when all the answer sections are empty #952

New issue

Open

opened 2026-03-16 01:04:32 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 01:04:32 +03:00

Owner

Originally created by @japaric on GitHub (Jul 4, 2024).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2282

Originally assigned to: @japaric on GitHub.

context: https://github.com/hickory-dns/hickory-dns/pull/2253#discussion_r1648668063

the current logic in the recursor store is going to set the AD bit when the answer, and other sections, are empty. write some tests to check if that's the right thing to do.

there are probably at least two cases here:

NSEC(3) is enabled. AD bit is probably only set if the name servers supplied all the required NSEC(3) information
NSEC(3) is disabled. here it's unclear if the AD bit should be set. perhaps this should result in a SERVFAIL status

Originally created by @japaric on GitHub (Jul 4, 2024). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2282 Originally assigned to: @japaric on GitHub. context: https://github.com/hickory-dns/hickory-dns/pull/2253#discussion_r1648668063 the current logic in the [recursor store](https://github.com/hickory-dns/hickory-dns/blob/9ff33b91f7fa7d0d1ee86e2c2f5244581f8c78c1/crates/server/src/store/recursor/authority.rs#L179) is going to set the AD bit when the answer, and other sections, are empty. write some tests to check if that's the right thing to do. there are probably at least two cases here: - NSEC(3) is enabled. AD bit is probably only set if the name servers supplied all the required NSEC(3) information - NSEC(3) is disabled. here it's unclear if the AD bit should be set. perhaps this should result in a SERVFAIL status