[PR #2523] [MERGED] Conformance dnslib support #3108

New issue

Closed

opened 2026-03-16 11:25:34 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:25:34 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/2523
Author: @marcus0x62
Created: 10/23/2024
Status: ✅ Merged
Merged: 10/24/2024
Merged by: @marcus0x62

Base: main ← Head: conformance_dnslib

📝 Commits (2)

fc57a0e Add Dnslib implementation to dns-test
a756c9b Add incorrect txid test to e2e test suite

📊 Changes

8 files changed (+158 additions, -2 deletions)

View changed files

📝 conformance/packages/dns-test/src/container.rs (+18 -0)
➕ conformance/packages/dns-test/src/docker/dnslib.Dockerfile (+6 -0)
📝 conformance/packages/dns-test/src/implementation.rs (+23 -0)
📝 conformance/packages/dns-test/src/name_server.rs (+26 -2)
📝 tests/e2e-tests/src/recursor.rs (+1 -0)
➕ tests/e2e-tests/src/recursor/security.rs (+1 -0)
➕ tests/e2e-tests/src/recursor/security/bad_txid.py (+22 -0)
➕ tests/e2e-tests/src/recursor/security/scenarios.rs (+61 -0)

📄 Description

This PR adds support for a new implementation target for the conformance test suite: a container that is designed to run a Python script using dnslib. This purpose of this target is to easily support end to end tests that involve abnormal or incorrect DNS responses that could not easily be generated using regular DNS servers, but with more flexibility than a packet capture replay.

This also includes an example test that verifies Hickory is dropping messages with incorrect transaction IDs.

My rationale for using dnslib is:

The library is reasonably popular, is easy to write test servers with, and is commonly used by researchers writing DNS attack proofs of concept.
Good feature support for the class of problems we will likely want to write tests for - invalid headers, cache poisoning attacks, bad referrals, etc.
Easy to integrate with the dns-test framework

cc: @bluejekyll and @djc

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/2523 **Author:** [@marcus0x62](https://github.com/marcus0x62) **Created:** 10/23/2024 **Status:** ✅ Merged **Merged:** 10/24/2024 **Merged by:** [@marcus0x62](https://github.com/marcus0x62) **Base:** `main` ← **Head:** `conformance_dnslib` --- ### 📝 Commits (2) - [`fc57a0e`](https://github.com/hickory-dns/hickory-dns/commit/fc57a0ecc340c8c632be0a1d5f595319935cfa88) Add Dnslib implementation to dns-test - [`a756c9b`](https://github.com/hickory-dns/hickory-dns/commit/a756c9bf99a1a09d8711b5545109e1eaff7fe3f9) Add incorrect txid test to e2e test suite ### 📊 Changes **8 files changed** (+158 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `conformance/packages/dns-test/src/container.rs` (+18 -0) ➕ `conformance/packages/dns-test/src/docker/dnslib.Dockerfile` (+6 -0) 📝 `conformance/packages/dns-test/src/implementation.rs` (+23 -0) 📝 `conformance/packages/dns-test/src/name_server.rs` (+26 -2) 📝 `tests/e2e-tests/src/recursor.rs` (+1 -0) ➕ `tests/e2e-tests/src/recursor/security.rs` (+1 -0) ➕ `tests/e2e-tests/src/recursor/security/bad_txid.py` (+22 -0) ➕ `tests/e2e-tests/src/recursor/security/scenarios.rs` (+61 -0) </details> ### 📄 Description This PR adds support for a new implementation target for the conformance test suite: a container that is designed to run a Python script using [dnslib](https://github.com/paulc/dnslib/). This purpose of this target is to easily support end to end tests that involve abnormal or incorrect DNS responses that could not easily be generated using regular DNS servers, but with more flexibility than a packet capture replay. This also includes an example test that verifies Hickory is dropping messages with incorrect transaction IDs. My rationale for using dnslib is: * The library is reasonably popular, is easy to write test servers with, and is commonly used by researchers writing DNS attack proofs of concept. * Good feature support for the class of problems we will likely want to write tests for - invalid headers, cache poisoning attacks, bad referrals, etc. * Easy to integrate with the dns-test framework cc: @bluejekyll and @djc --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>