starred/hickory-dns

Fork 0

mirror of https://github.com/hickory-dns/hickory-dns.git synced 2026-04-25 03:05:51 +03:00

[GH-ISSUE #134] Remove key generation from tests #361

New issue

Open

opened 2026-03-15 22:09:19 +03:00 by kerem · 8 comments

kerem commented

2026-03-15 22:09:19 +03:00

Owner

Originally created by @bluejekyll on GitHub (May 17, 2017).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/134

Instead checkin static keys to be used for all testing. This will allow OpenSSL to be dropped as a dependency for tests.

Originally created by @bluejekyll on GitHub (May 17, 2017). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/134 Instead checkin static keys to be used for all testing. This will allow OpenSSL to be dropped as a dependency for tests.

kerem added the

cleanup

label

2026-03-15 22:09:19 +03:00

kerem commented

2026-03-15 22:09:29 +03:00

Author

Owner

@bluejekyll commented on GitHub (Aug 24, 2017):

This should remove the requirement for OpenSSL as required dev-dependency.

@bluejekyll commented on GitHub (Aug 24, 2017): This should remove the requirement for OpenSSL as required dev-dependency.

kerem commented

2026-03-15 22:09:35 +03:00

Author

Owner

@shammancer commented on GitHub (Aug 25, 2017):

Which tests would you want to remove OpenSSL from?

@shammancer commented on GitHub (Aug 25, 2017): Which tests would you want to remove OpenSSL from?

kerem commented

2026-03-15 22:09:40 +03:00

Author

Owner

@shammancer commented on GitHub (Aug 25, 2017):

Why do you have so many different tls implementations?

@shammancer commented on GitHub (Aug 25, 2017): Why do you have so many different tls implementations?

kerem commented

2026-03-15 22:09:45 +03:00

Author

Owner

@shammancer commented on GitHub (Aug 25, 2017):

Are the test just testing the same functionality in native-tls, rustls, client/src/tls?

@shammancer commented on GitHub (Aug 25, 2017): Are the test just testing the same functionality in native-tls, rustls, client/src/tls?

kerem commented

2026-03-15 22:09:50 +03:00

Author

Owner

@bluejekyll commented on GitHub (Aug 25, 2017):

There are different TLS implementations for different situations. OpenSSL is the default, most general implementation. Rustls is a pure Rust implementation with a dependency on the ring library instead. NativeTLS allows the system default to be used. Each of these is valuable for different scenarios based on peoples needs.

In terms of proof of the DNSSec chain, it's currently split between requiring OpenSSL for some functions and ring for others.

In terms of private keys that are generated, and example is on

github.com/bluejekyll/trust-dns@26ce62f137/server/tests/common/authority.rs (L169)

If you run rg '::generate\(' **/*.rs at the root of the project, it will give a pretty decent list of what needs to be changed. (this uses ripgrep which can be installed with cargo install ripgrep if you're not familiar with it).

What I was thinking of doing for this, was to generate some RSA keys int /tests and use those by loading thing into each test as needed. Does that make sense?

@bluejekyll commented on GitHub (Aug 25, 2017): There are different TLS implementations for different situations. OpenSSL is the default, most general implementation. Rustls is a pure Rust implementation with a dependency on the *ring* library instead. NativeTLS allows the system default to be used. Each of these is valuable for different scenarios based on peoples needs. In terms of proof of the DNSSec chain, it's currently split between requiring OpenSSL for some functions and *ring* for others. In terms of private keys that are generated, and example is on https://github.com/bluejekyll/trust-dns/blob/26ce62f1372d70cd93ff3fdaecc3708da307315f/server/tests/common/authority.rs#L169 If you run `rg '::generate\(' **/*.rs ` at the root of the project, it will give a pretty decent list of what needs to be changed. (this uses ripgrep which can be installed with `cargo install ripgrep` if you're not familiar with it). What I was thinking of doing for this, was to generate some RSA keys int /tests and use those by loading thing into each test as needed. Does that make sense?

kerem commented

2026-03-15 22:09:55 +03:00

Author

Owner

@briansmith commented on GitHub (Sep 22, 2017):

What I was thinking of doing for this, was to generate some RSA keys int /tests and use those by loading thing into each test as needed. Does that make sense?

Yes, that makes sense. In particular, I recommend generating them in PKCS#8 format because that's the format that every crypto library seems to natively support now.

Uncoincidentally, I wrote a guide to generating PKCS#8-formatted keys in all the necessary formats and key sizes (except legacy RSA key sizes) here: https://gist.github.com/briansmith/2ee42439923d8e65a266994d0f70180b

@briansmith commented on GitHub (Sep 22, 2017): > What I was thinking of doing for this, was to generate some RSA keys int /tests and use those by loading thing into each test as needed. Does that make sense? Yes, that makes sense. In particular, I recommend generating them in PKCS#8 format because that's the format that every crypto library seems to natively support now. Uncoincidentally, I wrote a guide to generating PKCS#8-formatted keys in all the necessary formats and key sizes (except legacy RSA key sizes) here: https://gist.github.com/briansmith/2ee42439923d8e65a266994d0f70180b

kerem commented

2026-03-15 22:10:00 +03:00

Author

Owner

@briansmith commented on GitHub (Sep 22, 2017):

Also, in case you don't know, you can use include_bytes! to include a file as a &[u8] value. See the ring doc tests for examples.

@briansmith commented on GitHub (Sep 22, 2017): Also, in case you don't know, you can use `include_bytes!` to include a file as a `&[u8]` value. See the *ring* doc tests for examples.

kerem commented

2026-03-15 22:10:05 +03:00

Author

Owner

@briansmith commented on GitHub (Oct 24, 2017):

Once this is done, all the ring tests can be run even when openssl is disabled. That should be done after this.

@briansmith commented on GitHub (Oct 24, 2017): Once this is done, all the *ring* tests can be run even when openssl is disabled. That should be done after this.

kerem referenced this issue

2026-03-16 02:03:30 +03:00

[PR #361] [MERGED] Upgrade tokio to 0.1.15 #1381