[GH-ISSUE #2312] test 'Serial Number arithmetic' edge cases involving RRSIG's `{inception,expiration}` #962

New issue

Closed

opened 2026-03-16 01:06:13 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 01:06:13 +03:00

Owner

Originally created by @japaric on GitHub (Jul 16, 2024).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2312

Originally assigned to: @justahero on GitHub.

validating a RRSIG involves comparing the current time (seconds since UNIX_EPOCH) against the {inception,expiration} fields of the RRSIG (see section 5.3.1 of RFC4035). Section 3.1.5 of RFC4034 indicates that the {inception,expiration} are not plain unsigned-integers but rather 'Serial Numbers' whose comparison logic in specified in RFC1982.

we should test what the behavior of other DNS implementations is when the value of these 32-bit {inception,expiration} fields is 1 << 31 seconds beyond UNIX_EPOCH, 1 << 32 seconds beyond UNIX_EPOCH and even beyond that.

cc @justahero

Originally created by @japaric on GitHub (Jul 16, 2024). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2312 Originally assigned to: @justahero on GitHub. validating a RRSIG involves comparing the current time (seconds since UNIX_EPOCH) against the {inception,expiration} fields of the RRSIG (see section 5.3.1 of RFC4035). Section 3.1.5 of RFC4034 indicates that the {inception,expiration} are not plain unsigned-integers but rather 'Serial Numbers' whose comparison logic in specified in RFC1982. we should test what the behavior of other DNS implementations is when the value of these 32-bit {inception,expiration} fields is 1 << 31 seconds beyond UNIX_EPOCH, 1 << 32 seconds beyond UNIX_EPOCH and even beyond that. cc @justahero