starred/hickory-dns
1
0
Fork 0
mirror of https://github.com/hickory-dns/hickory-dns.git synced 2026-04-24 18:55:55 +03:00
Code Issues 373 Projects Releases 6 Packages Wiki Activity

[GH-ISSUE #2389] DNSSEC false positives #976

New issue
Closed
opened 2026-03-16 01:08:49 +03:00 by kerem · 2 comments
kerem commented 2026-03-16 01:08:49 +03:00
Owner
Copy link

Originally created by @japaric on GitHub (Aug 27, 2024).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2389

Describe the bug
These are scenarios where hickory-dns sets the AD flag in the response when it ought not

To Reproduce
Send queries of the form A $SUB.extended-dns-errors.com. to hickory where $SUB is one of these

  • bad-ksk
  • bad-rrsig-dnskey
  • bad-rrsig-ksk
  • ds-bad-key-algo
  • ds-bad-tag
  • ds-bogus-digest-value
  • ds-reserved-key-algo
  • ds-unassigned-key-algo
  • no-dnskey-257
  • no-ds
  • no-ksk
  • no-rrsig-dnskey
  • no-rrsig-ksk

Expected behavior

In the case of these subdomains ds-reserved-key-algo, ds-unassigned-key-algo, no-ds, unbound responds with NOERROR and the AD flag unset. In the other cases, unbound responds with SERVFAIL.

hickory should behave similarly and definitively should not set the AD flag in the response.

System:

  • OS: Ubuntu
  • Architecture: x86_64
  • Version 24.04
  • rustc version: 1.80.1

Version:
Crate: hickory-dns
Version: 77bd54e2ca

Additional context
Results produced using the test suite that's being added in #2385

Originally created by @japaric on GitHub (Aug 27, 2024). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2389 **Describe the bug** These are scenarios where hickory-dns sets the AD flag in the response when it ought not **To Reproduce** Send queries of the form `A $SUB.extended-dns-errors.com.` to hickory where `$SUB` is one of these - [x] bad-ksk - [x] bad-rrsig-dnskey - [x] bad-rrsig-ksk - [x] ds-bad-key-algo - [x] ds-bad-tag - [x] ds-bogus-digest-value - [x] ds-reserved-key-algo - [x] ds-unassigned-key-algo - [x] no-dnskey-257 - ~~no-ds~~ - [x] no-ksk - [x] no-rrsig-dnskey - [x] no-rrsig-ksk **Expected behavior** In the case of these subdomains `ds-reserved-key-algo`, `ds-unassigned-key-algo`, `no-ds`, unbound responds with NOERROR and the AD flag unset. In the other cases, unbound responds with SERVFAIL. hickory should behave similarly and definitively should not set the AD flag in the response. **System:** - OS: Ubuntu - Architecture: x86_64 - Version 24.04 - rustc version: 1.80.1 **Version:** Crate: `hickory-dns` Version: 77bd54e2ca98973b40210f20772d5f7f2de18143 **Additional context** Results produced using the test suite that's being added in #2385
kerem 2026-03-16 01:08:49 +03:00
kerem commented 2026-03-16 01:09:05 +03:00
Author
Owner
Copy link

@djc commented on GitHub (Sep 3, 2024):

Still two checkboxes left, should this be kept open for now?

<!-- gh-comment-id:2326282970 --> @djc commented on GitHub (Sep 3, 2024): Still two checkboxes left, should this be kept open for now?
kerem commented 2026-03-16 01:09:10 +03:00
Author
Owner
Copy link

@japaric commented on GitHub (Sep 3, 2024):

no, those last two were fixed in #2399 : https://github.com/hickory-dns/hickory-dns/pull/2399/files#diff-59514c0e8f8e69369efb4c2ce32d3f0b9a9a5ba2db81351215b8c8971644ce56

<!-- gh-comment-id:2326300684 --> @japaric commented on GitHub (Sep 3, 2024): no, those last two were fixed in #2399 : https://github.com/hickory-dns/hickory-dns/pull/2399/files#diff-59514c0e8f8e69369efb4c2ce32d3f0b9a9a5ba2db81351215b8c8971644ce56
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
david/test-server-docker-optimization
query-api
opt-types
cname-nsec
query-message
no-cname-recursion
conformance-min-ttl
dname-base
drop-message-request
no-error-queries
cpu-sig0-rm-message-sig_dev
cpu-tsig-test-update_dev
windows-config
dnssec-net
release/0.25
opp-enc-persist
integration-test
cpu-tidying-recursor-opts_dev
happy-eyeballs
david/authoritative-zone-storage-trait
dnssec-ad
no-authority
release/0.24
pvdrz/remove-top-file
pvdrz/h3-handshake-timeout
pvdrz/quic-handshake-timeout
nxdomain-for-recursor
ja-test-merque-queue
ja-fix-ci-again
sz-add-ede-tests
sz-test-tc-bit-with-large-response
sz-fix-tokio-dependency
gh-2275-test-rrsig-signature
refactor-sign-zone-file
fix-1.79-cleanliness
update-nightly-hash
release/0.23
gh-pages
use-just-for-server-toml
release/0.22
revert-1874-cpu-zone-parse-default-class
disable-bind-compatibility-tests
disable-test_tls_client_stream_ipv4
update-native-tls-0.2.11
recursor-tests
fix-clippy-self
release/0.20
saethlin-fix-rdata-zero
release/0.19
flat_name
drop_unused_futures
release/0.18
release-r0.12-cs0.17
release/r0.12-cs0.17
trust-dns-book
r0.10
test-connections-not-dropped
fix_exec_status_on_rs_files
release-0.9
add-mutex-to-integration-tests
0.8_release
bfry/dns-crypt
v0.26.0
v0.26.0-beta.4
v0.26.0-beta.3
v0.26.0-beta.2
v0.26.0-beta.1
v0.26.0-alpha.1
v0.25.2
v0.25.1
v0.25.0
v0.24.4
v0.24.3
v0.25.0-alpha.5
v0.24.2
v0.25.0-alpha.4
v0.25.0-alpha.3
v0.25.0-alpha.2
v0.25.0-alpha.1
v0.24.1
v0.23.2
v0.24.0
v0.23.1
v0.23.0
v0.23.0-alpha.5
v0.23.0-alpha.4
v0.23.0-alpha.3
v0.22.1
v0.23.0-alpha.2
v0.23.0-alpha.1
v0.22.0
v0.21.2
v0.21.1
v0.21.0
v0.21.0-alpha.5
v0.20.4
v0.21.0-alpha.4
v0.21.0-alpha.3
v0.21.0-alpha.2
v0.21.0-alpha.1
v0.20.3
v0.20.2
v0.20.1
v0.19.7
v0.20.0
0.19.6
v0.20.0-alpha.3
v0.20.0-alpha.2
v0.20.0-alpha.1
0.19.5
0.19.4
0.19.3
0.19.0
0.18.1
0.18
0.18.0.alpha.2
r0.12_cs0.17
r0.11.1
cs0.16.1
r0.11
cs0.16
r0.10.1
r0.10.0
cs0.15.0
r0.9.1
v0.14.0
r0.9.0
r0.8.1
r0.8.0
v0.13.0
r0.7.0
c0.12.0
r0.6.0
r0.5.0
resolver.0.4.0
0.11.0
0.10.5
0.10.4
0.10.3
0.10.2
0.10.1
0.10.0
0.9.3
0.9.2
0.9.1
0.9.0
0.8.1
0.8.0
0.7.3
0.7.2
0.7.1
0.7.0
0.6.0
0.5.3
0.5.1
0.5.0
0.4.0
0.3.1
0.3.0
0.2.1
0.2.0
0.1.0
Labels
Clear labels   
blocked

   
breaking-change

   
bug

   
bug:critical

   
bug:tests

   
cleanup

   
compliance

   
compliance

   
compliance

   
crate:all

   
crate:client

   
crate:native-tls

   
crate:proto

   
crate:recursor

   
crate:resolver

   
crate:resolver

   
crate:rustls

   
crate:server

   
crate:util

   
dependencies

   
docs

   
duplicate

   
easy

   
easy

   
enhance

   
enhance

   
enhance

   
feature:dns-over-https

   
feature:dns-over-quic

   
feature:dns-over-tls

   
feature:dnsssec

   
feature:global_lb

   
feature:mdns

   
feature:tsig

   
features:edns

   
has workaround

   
ops

   
perf

   
platform:WASM

   
platform:android

   
platform:fuchsia

   
platform:linux

   
platform:macos

   
platform:windows

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
test

   
tools

   
tools

   
trust

   
unclear

   
wontfix
No labels
blocked
breaking-change
bug
bug:critical
bug:tests
cleanup
compliance
compliance
compliance
crate:all
crate:client
crate:native-tls
crate:proto
crate:recursor
crate:resolver
crate:resolver
crate:rustls
crate:server
crate:util
dependencies
docs
duplicate
easy
easy
enhance
enhance
enhance
feature:dns-over-https
feature:dns-over-quic
feature:dns-over-tls
feature:dnsssec
feature:global_lb
feature:mdns
feature:tsig
features:edns
has workaround
ops
perf
platform:WASM
platform:android
platform:fuchsia
platform:linux
platform:macos
platform:windows
pull-request
question
test
tools
tools
trust
unclear
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/hickory-dns#976
No description provided.