[GH-ISSUE #3306] Invalid TTL for RRSIG records #1167

New issue

Closed

opened 2026-03-16 01:47:25 +03:00 by kerem · 1 comment

kerem commented

2026-03-16 01:47:25 +03:00

Owner

Originally created by @msrd0 on GitHub (Oct 11, 2025).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/3306

Describe the bug

According to RFC4034:

The TTL value of an RRSIG RR MUST match the TTL value of the RRset it covers.

I however observed this network response from hickory-dns:

$ kdig +dnssec -p 1234 www.example.com @localhost
;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 26705
;; Flags: qr aa rd; QUERY: 1; ANSWER: 6; AUTHORITY: 0; ADDITIONAL: 1

;; EDNS PSEUDOSECTION:
;; Version: 0; flags: do; UDP size: 1232 B; ext-rcode: NOERROR

;; QUESTION SECTION:
;; www.example.com.    		IN	A

;; ANSWER SECTION:
www.example.com.    	900	IN	A	127.0.0.1
www.example.com.    	86400	IN	RRSIG	A 8 3 900 20261010160343 20251011160343 30434 example.com. a8IMfado/PSPtQ3579guzia8xJK2N/w75yyBqX8LPO8fFlhwgLD+PebeEel652zsSJz8p3X2CGUWVEAnM6atE2SExzbXq9/eOQe4r0YPKtVNGQuG/S0Mbft+XcWwiyOp39DAFBG4ADToet5OSV8BKHtD6rrd+qeE8xZHqT8KcZOEqb38SJcWmXUwF8XzDWTOnNQQTGKxDsoVYSKPy7oIRulwZ+Jdb7t4eG3/XAXhC4r9SpJ5RcpyPYXnXlx98r3bozWX6V6GhcYYqTKvlbTzEvvxDJCLHgtSjm/YLq0nCe6IgMHugGK9/tYdxofpXlXVEsXGVfM/nz9nbWJGKe6g1w==
www.example.com.    	86400	IN	RRSIG	A 10 3 900 20261010160343 20251011160343 30436 example.com. PgkR2LC9KwKdqADOiTgXshCUSiKf48Wh87kDfETTI8WpvDjBHhdSwMC8NpJvTaFhSGd0ZGGgXUIv4Wxf2KBVKOT9Lw7hOJtXI5IiesH1Tpqamjpka+CQtc3MjM6/ZAH0Tn+QurajgQHFmV9S6PbnBnCt22C4y5MLUvjCNnMQ3lwxveBjRg/IypEQMlGPPX+I5ZTmeRdxqMs1mEI+PeJ2+jDBM4x2vSyRhOjyhzHIpMOicyirkigeSC1OtQth9FhQRE5YQzgGMMMuehXFnhOJPAiy2ZNfepOZnrsaip+L/s0eFHgwkzvzKkeDUzcRKu+L9oXvIUnwGSoCEv1j9hr8fg==
www.example.com.    	86400	IN	RRSIG	A 13 3 900 20261010160343 20251011160343 9436 example.com. QNY8vNRRxt9fKBiGEWehz6Jg9MA2+yxJEfDrV1xfn14jtm9JwK9/46R6rMMvn8JUT0Lz73RKRB38P0gwwlikDQ==
www.example.com.    	86400	IN	RRSIG	A 14 3 900 20261010160343 20251011160343 52623 example.com. 1VgsxZ76gXy/ziyS//h9nBV9GIebQhtFeGW7lICc+7kuB+kkfHG2j1Akq9CDeXhjJJjMJF6ddmdvQW0v9Mw+bawSBQDKJ3WtqYnzKwkiA0zQf8kAI0SOiex+v/zmZAmI
www.example.com.    	86400	IN	RRSIG	A 15 3 900 20261010160343 20251011160343 45440 example.com. lq8Z7TbJi6c7DU7OI+6CHvwXOUBk3NDQMdn9FnZySBiC2Yjdq38zFQWC0f+JqBHYqKgi6G+/3PRvXDUp/9yHDw==

;; Received 1026 B
;; Time 2025-10-11 18:03:45 CEST
;; From ::1@1234(UDP) in 0.5 ms

This is in clear violation of the RFC.

To Reproduce
Steps to reproduce the behaviour:

Change the TTL for a record, e.g.

diff --git a/tests/test-data/test_configs/example.com.zone b/tests/test-data/test_configs/example.com.zone
index 94ee3a107..e0c8c6b2a 100644
--- a/tests/test-data/test_configs/example.com.zone
+++ b/tests/test-data/test_configs/example.com.zone
@@ -12,6 +12,8 @@

                ANAME   www

+$TTL 900
+
www             A       127.0.0.1
                AAAA    ::1

Run cargo run --bin hickory-dns --features dnssec-ring -- -c test-data/test_configs/all_supported_dnssec.toml -p 1234 -z test-data/test_configs/ in the tests folder of this repository

Expected behavior
The RRSIG records should match the TTL of the A record they are signing.

System:

OS: I use Arch btw
Architecture: x86_64
Version: rolling release
rustc version: rustc 1.90.0 (1159e78c4 2025-09-14)

Version:
Crate: hickory-dns
Version: latest git commit dfcbc6a0b5

Originally created by @msrd0 on GitHub (Oct 11, 2025). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/3306 **Describe the bug** According to [RFC4034]: > The TTL value of an RRSIG RR MUST match the TTL value of the RRset it covers. I however observed this network response from hickory-dns: ``` $ kdig +dnssec -p 1234 www.example.com @localhost ;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 26705 ;; Flags: qr aa rd; QUERY: 1; ANSWER: 6; AUTHORITY: 0; ADDITIONAL: 1 ;; EDNS PSEUDOSECTION: ;; Version: 0; flags: do; UDP size: 1232 B; ext-rcode: NOERROR ;; QUESTION SECTION: ;; www.example.com. IN A ;; ANSWER SECTION: www.example.com. 900 IN A 127.0.0.1 www.example.com. 86400 IN RRSIG A 8 3 900 20261010160343 20251011160343 30434 example.com. a8IMfado/PSPtQ3579guzia8xJK2N/w75yyBqX8LPO8fFlhwgLD+PebeEel652zsSJz8p3X2CGUWVEAnM6atE2SExzbXq9/eOQe4r0YPKtVNGQuG/S0Mbft+XcWwiyOp39DAFBG4ADToet5OSV8BKHtD6rrd+qeE8xZHqT8KcZOEqb38SJcWmXUwF8XzDWTOnNQQTGKxDsoVYSKPy7oIRulwZ+Jdb7t4eG3/XAXhC4r9SpJ5RcpyPYXnXlx98r3bozWX6V6GhcYYqTKvlbTzEvvxDJCLHgtSjm/YLq0nCe6IgMHugGK9/tYdxofpXlXVEsXGVfM/nz9nbWJGKe6g1w== www.example.com. 86400 IN RRSIG A 10 3 900 20261010160343 20251011160343 30436 example.com. PgkR2LC9KwKdqADOiTgXshCUSiKf48Wh87kDfETTI8WpvDjBHhdSwMC8NpJvTaFhSGd0ZGGgXUIv4Wxf2KBVKOT9Lw7hOJtXI5IiesH1Tpqamjpka+CQtc3MjM6/ZAH0Tn+QurajgQHFmV9S6PbnBnCt22C4y5MLUvjCNnMQ3lwxveBjRg/IypEQMlGPPX+I5ZTmeRdxqMs1mEI+PeJ2+jDBM4x2vSyRhOjyhzHIpMOicyirkigeSC1OtQth9FhQRE5YQzgGMMMuehXFnhOJPAiy2ZNfepOZnrsaip+L/s0eFHgwkzvzKkeDUzcRKu+L9oXvIUnwGSoCEv1j9hr8fg== www.example.com. 86400 IN RRSIG A 13 3 900 20261010160343 20251011160343 9436 example.com. QNY8vNRRxt9fKBiGEWehz6Jg9MA2+yxJEfDrV1xfn14jtm9JwK9/46R6rMMvn8JUT0Lz73RKRB38P0gwwlikDQ== www.example.com. 86400 IN RRSIG A 14 3 900 20261010160343 20251011160343 52623 example.com. 1VgsxZ76gXy/ziyS//h9nBV9GIebQhtFeGW7lICc+7kuB+kkfHG2j1Akq9CDeXhjJJjMJF6ddmdvQW0v9Mw+bawSBQDKJ3WtqYnzKwkiA0zQf8kAI0SOiex+v/zmZAmI www.example.com. 86400 IN RRSIG A 15 3 900 20261010160343 20251011160343 45440 example.com. lq8Z7TbJi6c7DU7OI+6CHvwXOUBk3NDQMdn9FnZySBiC2Yjdq38zFQWC0f+JqBHYqKgi6G+/3PRvXDUp/9yHDw== ;; Received 1026 B ;; Time 2025-10-11 18:03:45 CEST ;; From ::1@1234(UDP) in 0.5 ms ``` This is in clear violation of the RFC. **To Reproduce** Steps to reproduce the behaviour: 1. Change the TTL for a record, e.g. ```patch diff --git a/tests/test-data/test_configs/example.com.zone b/tests/test-data/test_configs/example.com.zone index 94ee3a107..e0c8c6b2a 100644 --- a/tests/test-data/test_configs/example.com.zone +++ b/tests/test-data/test_configs/example.com.zone @@ -12,6 +12,8 @@ ANAME www +$TTL 900 + www A 127.0.0.1 AAAA ::1 ``` 2. Run `cargo run --bin hickory-dns --features dnssec-ring -- -c test-data/test_configs/all_supported_dnssec.toml -p 1234 -z test-data/test_configs/` in the `tests` folder of this repository **Expected behavior** The RRSIG records should match the TTL of the A record they are signing. **System:** - OS: I use Arch btw - Architecture: x86_64 - Version: rolling release - rustc version: rustc 1.90.0 (1159e78c4 2025-09-14) **Version:** Crate: hickory-dns Version: latest git commit dfcbc6a0b51adc329ce0558fc30bf34d3a0a826b [RFC4034]: https://datatracker.ietf.org/doc/html/rfc4034#section-3

kerem closed this issue

2026-03-16 01:47:30 +03:00

kerem commented

2026-03-16 01:47:36 +03:00

Author

Owner

@marcus0x62 commented on GitHub (Oct 12, 2025):

It will be a few days until I can look at this further and add test coverage, but if you (or anyone else) wants to take a stab at this, the fix appears to be:

diff --git a/crates/server/src/store/in_memory/inner.rs b/crates/server/src/store/in_memory/inner.rs
index 8487265a3..26b0611d5 100644
--- a/crates/server/src/store/in_memory/inner.rs
+++ b/crates/server/src/store/in_memory/inner.rs
@@ -735,7 +735,7 @@ impl InnerInMemory {

             rr_set.insert_rrsig(Record::from_rdata(
                 rr_set.name().clone(),
-                zone_ttl,
+                rr_set.ttl(),
                 RData::DNSSEC(DNSSECRData::RRSIG(rrsig)),
             ));
         }

@marcus0x62 commented on GitHub (Oct 12, 2025): It will be a few days until I can look at this further and add test coverage, but if you (or anyone else) wants to take a stab at this, the fix appears to be: ``` diff --git a/crates/server/src/store/in_memory/inner.rs b/crates/server/src/store/in_memory/inner.rs index 8487265a3..26b0611d5 100644 --- a/crates/server/src/store/in_memory/inner.rs +++ b/crates/server/src/store/in_memory/inner.rs @@ -735,7 +735,7 @@ impl InnerInMemory { rr_set.insert_rrsig(Record::from_rdata( rr_set.name().clone(), - zone_ttl, + rr_set.ttl(), RData::DNSSEC(DNSSECRData::RRSIG(rrsig)), )); } ```

kerem referenced this issue

2026-03-16 04:58:05 +03:00

[PR #1167] [MERGED] Bump h2 from 0.2.5 to 0.2.6 #2037