[PR #2298] [MERGED] Test invalid signature timestamps in DNSSEC validation #2930

New issue

Closed

opened 2026-03-16 11:16:03 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:16:03 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/2298
Author: @justahero
Created: 7/9/2024
Status: ✅ Merged
Merged: 7/10/2024
Merged by: @japaric

Base: main ← Head: gh-2275-test-rrsig-signature

📝 Commits (5)

a07d250 Pass trust anchor from previous 'State'
2b28cce Extract logic to sign zone file
15178b2 Add test to check signature inception timestamp
e4ce41c Add test to check expiration timestamp
12fcc3c Skip assertion when using unbound

📊 Changes

17 files changed (+354 additions, -109 deletions)

View changed files

📝 conformance/packages/conformance-tests/src/name_server/rfc4035/section_3/section_3_1/section_3_1_1.rs (+2 -1)
📝 conformance/packages/conformance-tests/src/name_server/rfc5155.rs (+2 -1)
📝 conformance/packages/conformance-tests/src/resolver/dnssec/fixtures.rs (+2 -1)
📝 conformance/packages/conformance-tests/src/resolver/dnssec/rfc4035.rs (+1 -0)
📝 conformance/packages/conformance-tests/src/resolver/dnssec/rfc4035/section_3/section_3_1/section_3_1_4.rs (+2 -1)
📝 conformance/packages/conformance-tests/src/resolver/dnssec/rfc4035/section_3/section_3_2.rs (+2 -1)
📝 conformance/packages/conformance-tests/src/resolver/dnssec/rfc4035/section_4/section_4_5.rs (+2 -1)
➕ conformance/packages/conformance-tests/src/resolver/dnssec/rfc4035/section_5.rs (+1 -0)
➕ conformance/packages/conformance-tests/src/resolver/dnssec/rfc4035/section_5/section_5_3.rs (+82 -0)
📝 conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/ede.rs (+2 -1)
📝 conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/secure.rs (+2 -1)
📝 conformance/packages/dns-test/examples/explore.rs (+2 -1)
📝 conformance/packages/dns-test/src/implementation.rs (+5 -0)
📝 conformance/packages/dns-test/src/name_server.rs (+35 -99)
📝 conformance/packages/dns-test/src/zone_file/mod.rs (+4 -0)
➕ conformance/packages/dns-test/src/zone_file/signer.rs (+206 -0)
📝 tests/e2e-tests/src/resolver/dnssec/regression.rs (+2 -1)

📄 Description

This PR adds support to sign zone files with invalid signature timestamps, e.g. inception or expiration, to produce signed invalid records (using ldns-signzone internally).

The Signer type moved to its own file, using the expanded SignSettings type to set the properties. A small refactoring allows the Signed state to return a TrustAnchor. A NameServer can return a set TrustAnchor. If it's a non Signed name server this will return None, otherwise it's expected to return a valid TrustAnchor. This should improve usability of setting up a trust anchor for Resolvers in tests slightly.

add tests to check timestamp related validations

Closes #2275

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/2298 **Author:** [@justahero](https://github.com/justahero) **Created:** 7/9/2024 **Status:** ✅ Merged **Merged:** 7/10/2024 **Merged by:** [@japaric](https://github.com/japaric) **Base:** `main` ← **Head:** `gh-2275-test-rrsig-signature` --- ### 📝 Commits (5) - [`a07d250`](https://github.com/hickory-dns/hickory-dns/commit/a07d250c13f27c51b508473b2deff59cbb1a2363) Pass trust anchor from previous 'State' - [`2b28cce`](https://github.com/hickory-dns/hickory-dns/commit/2b28cce392d2bfd059759d2f4c78790d5defa0f0) Extract logic to sign zone file - [`15178b2`](https://github.com/hickory-dns/hickory-dns/commit/15178b208e365012c8009f5b87557821598e28fe) Add test to check signature inception timestamp - [`e4ce41c`](https://github.com/hickory-dns/hickory-dns/commit/e4ce41c02770bd4b492c22ae8e56e7e27ed329b4) Add test to check expiration timestamp - [`12fcc3c`](https://github.com/hickory-dns/hickory-dns/commit/12fcc3ca405cda8116c2dd271c1412049116700f) Skip assertion when using unbound ### 📊 Changes **17 files changed** (+354 additions, -109 deletions) <details> <summary>View changed files</summary> 📝 `conformance/packages/conformance-tests/src/name_server/rfc4035/section_3/section_3_1/section_3_1_1.rs` (+2 -1) 📝 `conformance/packages/conformance-tests/src/name_server/rfc5155.rs` (+2 -1) 📝 `conformance/packages/conformance-tests/src/resolver/dnssec/fixtures.rs` (+2 -1) 📝 `conformance/packages/conformance-tests/src/resolver/dnssec/rfc4035.rs` (+1 -0) 📝 `conformance/packages/conformance-tests/src/resolver/dnssec/rfc4035/section_3/section_3_1/section_3_1_4.rs` (+2 -1) 📝 `conformance/packages/conformance-tests/src/resolver/dnssec/rfc4035/section_3/section_3_2.rs` (+2 -1) 📝 `conformance/packages/conformance-tests/src/resolver/dnssec/rfc4035/section_4/section_4_5.rs` (+2 -1) ➕ `conformance/packages/conformance-tests/src/resolver/dnssec/rfc4035/section_5.rs` (+1 -0) ➕ `conformance/packages/conformance-tests/src/resolver/dnssec/rfc4035/section_5/section_5_3.rs` (+82 -0) 📝 `conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/ede.rs` (+2 -1) 📝 `conformance/packages/conformance-tests/src/resolver/dnssec/scenarios/secure.rs` (+2 -1) 📝 `conformance/packages/dns-test/examples/explore.rs` (+2 -1) 📝 `conformance/packages/dns-test/src/implementation.rs` (+5 -0) 📝 `conformance/packages/dns-test/src/name_server.rs` (+35 -99) 📝 `conformance/packages/dns-test/src/zone_file/mod.rs` (+4 -0) ➕ `conformance/packages/dns-test/src/zone_file/signer.rs` (+206 -0) 📝 `tests/e2e-tests/src/resolver/dnssec/regression.rs` (+2 -1) </details> ### 📄 Description This PR adds support to sign zone files with invalid signature timestamps, e.g. inception or expiration, to produce signed invalid records (using `ldns-signzone` internally). The `Signer` type moved to its own file, using the expanded `SignSettings` type to set the properties. A small refactoring allows the `Signed` state to return a `TrustAnchor`. A `NameServer` can return a set `TrustAnchor`. If it's a non `Signed` name server this will return `None`, otherwise it's expected to return a valid `TrustAnchor`. This should improve usability of setting up a trust anchor for Resolvers in tests slightly. * add tests to check timestamp related validations Closes #2275 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>