Skip to content

fix: validate DNS answer names#853

Merged
ryanfowler merged 1 commit into
mainfrom
fix/validate-dns-answer-names
Jul 12, 2026
Merged

fix: validate DNS answer names#853
ryanfowler merged 1 commit into
mainfrom
fix/validate-dns-answer-names

Conversation

@ryanfowler

Copy link
Copy Markdown
Owner

Summary

  • validate DNS response flags, opcode, and the expected question
  • preserve answer owner names and restrict records to the queried name or validated CNAME chains
  • apply owner validation across resolver, DoH, inspection, and HTTPS/SVCB paths
  • add regressions for mismatched questions, query packets, unrelated owners, and CNAME chains

Validation

  • cargo test --locked --all-features --lib dns:: -- --nocapture
  • cargo clippy --locked --all-targets --all-features -- -D warnings

@ryanfowler ryanfowler merged commit 4c99ee1 into main Jul 12, 2026
4 checks passed
@ryanfowler ryanfowler deleted the fix/validate-dns-answer-names branch July 12, 2026 01:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant