[GH-ISSUE #2275] test that RRSIG signature expiration / validation fields are respected #947

New issue

Closed

opened 2026-03-16 01:03:55 +03:00 by kerem · 1 comment

kerem commented

2026-03-16 01:03:55 +03:00

Owner

Originally created by @japaric on GitHub (Jul 3, 2024).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2275

Originally assigned to: @justahero on GitHub.

this is a regression test for #2209

currently there's no API to tamper with a signed zone file and produce a valid signed zone file because that would require re-signing (regenerating the RRSIG records, etc.) the zone file and there's no code in dns-test that does that.

so, the easiest way to produce the bogus records required for this test could be to run the command date --set inside the container to fake the current time that the ldns-signzone tool sees.

note that these cases need to be tested:

inception > current_time (signature produced in the future)
current_time > expiration (signature has expired)
inception > expiration (malformed record) would also be nice to have but probably date --set won't be sufficient to produce that kind of record

after #2253 lands these tests should become green given that a fix already landed in #2213

Originally created by @japaric on GitHub (Jul 3, 2024). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2275 Originally assigned to: @justahero on GitHub. this is a regression test for #2209 currently there's no API to tamper with a *signed* zone file and produce a *valid* signed zone file because that would require re-signing (regenerating the RRSIG records, etc.) the zone file and there's no code in `dns-test` that does that. so, the easiest way to produce the bogus records required for this test could be to run the command `date --set` inside the container to fake the current time that the `ldns-signzone` tool sees. note that these cases need to be tested: - `inception > current_time` (signature produced in the future) - `current_time > expiration` (signature has expired) - `inception > expiration` (malformed record) would also be nice to have but probably `date --set` won't be sufficient to produce that kind of record after #2253 lands these tests should become green given that a fix already landed in #2213

kerem

2026-03-16 01:03:55 +03:00

closed this issue
added the
feature:dnsssec

test
labels

kerem commented

2026-03-16 01:04:12 +03:00

Author

Owner

@justahero commented on GitHub (Jul 9, 2024):

I think the inception > expiration check cannot be tested, because either the inception or the expiration timestamp are covered by the first two conditions.

@justahero commented on GitHub (Jul 9, 2024): I think the `inception > expiration` check cannot be tested, because either the `inception` or the `expiration` timestamp are covered by the first two conditions.

kerem referenced this issue

2026-03-16 02:26:59 +03:00

[PR #947] [CLOSED] Bump tokio from 0.2.2 to 0.2.4 #1814