[PR #1459] [MERGED] Add support for TSIG #2337

New issue

Closed

opened 2026-03-16 08:48:23 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 08:48:23 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/1459
Author: @trinity-1686a
Created: 4/15/2021
Status: ✅ Merged
Merged: 5/26/2021
Merged by: @bluejekyll

Base: main ← Head: tsig

📝 Commits (10+)

5e7ec6d sign XFR queries
9a3f465 add TSIG record type
5988ef2 add support for tsig on Message
6d0f527 add actual mac computation
c67d41e Add support for TSIG to client
ab9cca5 fix https and mdns clients and tests
981af86 add tests and doc-comments
4064d39 fix minimal version violation and fix intra-doc links
8bdc44c try to add tsig test against bind
8a19440 add mac verification

📊 Changes

36 files changed (+1753 additions, -81 deletions)

View changed files

📝 Cargo.lock (+90 -0)
📝 Makefile.toml (+1 -1)
📝 bin/tests/named_test_rsa_dnssec.rs (+1 -1)
📝 crates/client/src/client/async_client.rs (+1 -1)
📝 crates/client/src/client/client.rs (+20 -4)
📝 crates/client/src/client/client_connection.rs (+40 -1)
📝 crates/client/src/client/mod.rs (+1 -0)
📝 crates/client/src/https_client_connection.rs (+1 -2)
📝 crates/client/src/multicast/mdns_client_connection.rs (+1 -2)
📝 crates/client/src/op/mod.rs (+4 -1)
📝 crates/client/src/rr/dnssec/signer.rs (+12 -4)
📝 crates/client/src/rr/mod.rs (+1 -0)
➕ crates/client/src/rr/tsig.rs (+356 -0)
📝 crates/client/src/tcp/tcp_client_connection.rs (+1 -2)
📝 crates/client/src/udp/udp_client_connection.rs (+1 -1)
📝 crates/proto/Cargo.toml (+2 -0)
📝 crates/proto/src/op/message.rs (+102 -26)
📝 crates/proto/src/op/mod.rs (+3 -1)
📝 crates/proto/src/rr/rdata/mod.rs (+2 -0)
📝 crates/proto/src/rr/rdata/sshfp.rs (+1 -1)

...and 16 more files

📄 Description

This PR attempt to fix #14

⚠️ This PR contains breaking changes.

What was done:

change logic for what get signed, sign AXFR/IXFR queries and Notify messages, in addition to Update messages, as they often need signing too.
add code related to TSIG RR
add code related to auth code computation (add dependencies to hmac and sha2)
add support for sending signed requests on client
some tests, including against BIND
validate server answers as per RFC8945 5.3.1

What will probably not be done:

changes on the server-side. I don't need that right now, so I will probably not work on it, unless it ends up necessary for proper testing

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/1459 **Author:** [@trinity-1686a](https://github.com/trinity-1686a) **Created:** 4/15/2021 **Status:** ✅ Merged **Merged:** 5/26/2021 **Merged by:** [@bluejekyll](https://github.com/bluejekyll) **Base:** `main` ← **Head:** `tsig` --- ### 📝 Commits (10+) - [`5e7ec6d`](https://github.com/hickory-dns/hickory-dns/commit/5e7ec6d4e85a76d9bc5358dda2d09137ae49e42e) sign XFR queries - [`9a3f465`](https://github.com/hickory-dns/hickory-dns/commit/9a3f4653e5d53e37a12d1a1b0f3a48fbe5bbfaff) add TSIG record type - [`5988ef2`](https://github.com/hickory-dns/hickory-dns/commit/5988ef27b4c1adfa89d91f1470ade7da235b7546) add support for tsig on Message - [`6d0f527`](https://github.com/hickory-dns/hickory-dns/commit/6d0f527d67d857e4edc6d3bf8a44946e92d320b1) add actual mac computation - [`c67d41e`](https://github.com/hickory-dns/hickory-dns/commit/c67d41e535133c57f5bd0b709966e31853c4d596) Add support for TSIG to client - [`ab9cca5`](https://github.com/hickory-dns/hickory-dns/commit/ab9cca5c25c8c4839d5410ad97e54a1b50f968d5) fix https and mdns clients and tests - [`981af86`](https://github.com/hickory-dns/hickory-dns/commit/981af86f0180eb0f65aa3a12da5ccf8c4ca7eefb) add tests and doc-comments - [`4064d39`](https://github.com/hickory-dns/hickory-dns/commit/4064d3918a1897ab9ea7c84277d7f0575c473676) fix minimal version violation and fix intra-doc links - [`8bdc44c`](https://github.com/hickory-dns/hickory-dns/commit/8bdc44ce07d2697778f0c4a528ebad652ae057ed) try to add tsig test against bind - [`8a19440`](https://github.com/hickory-dns/hickory-dns/commit/8a194404f317dbe023076eea8a9cee5eff941cbb) add mac verification ### 📊 Changes **36 files changed** (+1753 additions, -81 deletions) <details> <summary>View changed files</summary> 📝 `Cargo.lock` (+90 -0) 📝 `Makefile.toml` (+1 -1) 📝 `bin/tests/named_test_rsa_dnssec.rs` (+1 -1) 📝 `crates/client/src/client/async_client.rs` (+1 -1) 📝 `crates/client/src/client/client.rs` (+20 -4) 📝 `crates/client/src/client/client_connection.rs` (+40 -1) 📝 `crates/client/src/client/mod.rs` (+1 -0) 📝 `crates/client/src/https_client_connection.rs` (+1 -2) 📝 `crates/client/src/multicast/mdns_client_connection.rs` (+1 -2) 📝 `crates/client/src/op/mod.rs` (+4 -1) 📝 `crates/client/src/rr/dnssec/signer.rs` (+12 -4) 📝 `crates/client/src/rr/mod.rs` (+1 -0) ➕ `crates/client/src/rr/tsig.rs` (+356 -0) 📝 `crates/client/src/tcp/tcp_client_connection.rs` (+1 -2) 📝 `crates/client/src/udp/udp_client_connection.rs` (+1 -1) 📝 `crates/proto/Cargo.toml` (+2 -0) 📝 `crates/proto/src/op/message.rs` (+102 -26) 📝 `crates/proto/src/op/mod.rs` (+3 -1) 📝 `crates/proto/src/rr/rdata/mod.rs` (+2 -0) 📝 `crates/proto/src/rr/rdata/sshfp.rs` (+1 -1) _...and 16 more files_ </details> ### 📄 Description This PR attempt to fix #14 ⚠️ This PR contains breaking changes. What was done: - change logic for what get signed, sign AXFR/IXFR queries and Notify messages, in addition to Update messages, as they often need signing too. - add code related to TSIG RR - add code related to auth code computation (add dependencies to [hmac](https://crates.io/crates/hmac) and [sha2](https://crates.io/crates/sha2)) - add support for sending signed requests on client - some tests, including against BIND - validate server answers as per [RFC8945 5.3.1](https://tools.ietf.org/html/rfc8945#section-5.3.1) What will probably _not_ be done: - changes on the server-side. I don't need that right now, so I will probably not work on it, unless it ends up necessary for proper testing --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>