Reject unsupported DNS opcodes consistently #7

Merged

ober merged 2 commits from fix/reject-unsupported-opcodes into master

2026-09-23 18:04:04 -04:00

ober commented

2026-09-23 17:34:51 -04:00

Owner

Summary

Reject unsupported nonzero DNS opcodes consistently in the Scheme and WASM query parsers. The existing server behavior for parser rejection is a silent drop, so UPDATE, NOTIFY, and other unsupported opcodes receive no ordinary QUERY response and cannot reach zone lookup.

The change also regenerates the tracked WASM payloads and embedded source, adds Scheme/WASM parity tests, and bumps the package version to 0.1.5.

Verification

PATH=/Users/user/.rustup/toolchains/stable-aarch64-apple-darwin/bin:$PATH DYLD_LIBRARY_PATH=/Users/user/.rustup/toolchains/stable-aarch64-apple-darwin/lib make test
make security
cargo fmt --manifest-path wasm/Cargo.toml --all -- --check
cargo check --manifest-path fuzz/Cargo.toml --locked --bins
Runtime startup smoke reached the daemon startup path and failed closed at the expected chroot permission boundary.

## Summary Reject unsupported nonzero DNS opcodes consistently in the Scheme and WASM query parsers. The existing server behavior for parser rejection is a silent drop, so UPDATE, NOTIFY, and other unsupported opcodes receive no ordinary QUERY response and cannot reach zone lookup. The change also regenerates the tracked WASM payloads and embedded source, adds Scheme/WASM parity tests, and bumps the package version to 0.1.5. ## Verification - `PATH=/Users/user/.rustup/toolchains/stable-aarch64-apple-darwin/bin:$PATH DYLD_LIBRARY_PATH=/Users/user/.rustup/toolchains/stable-aarch64-apple-darwin/lib make test` - `make security` - `cargo fmt --manifest-path wasm/Cargo.toml --all -- --check` - `cargo check --manifest-path fuzz/Cargo.toml --locked --bins` - Runtime startup smoke reached the daemon startup path and failed closed at the expected chroot permission boundary.

ober added 1 commit

2026-09-23 17:34:51 -04:00