[TochusC]

RFC 4034 §3.1.5 requires RFC 1982 serial number arithmetic for comparisons involving the 32-bit RRSIG inception and expiration fields. The current validator compares these fields directly with Unix time, so it rejects an otherwise valid signature whose validity interval crosses the rollover.

For example, a signature with inception 0xfffffff0 and expiration 0x00000020 is valid at Unix times 0xffffffff and 0x100000001. Both calls to validate_rrsig() currently raise ValidationFailure("expired").

This change uses dns.serial.Serial for both comparisons. It accepts the exact inception and expiration instants and preserves the fractional-second expiration check. Comparisons at the undefined half-range boundary fail the time check. Non-finite validation times raise ValidationFailure.

The regression test signs an RRset and exercises both sides of the rollover, both inclusive endpoints, fractional times just outside the interval, and the undefined half-range comparison. The test reproduced the false rejection before the change. The local offline suite passed with 1,645 tests passing and 131 skipped. Black, Ruff, Pyright, and ty also passed.

RFC 4034 §3.1.5 · RFC 4035 §5.3.1 · RFC 1982 §3.2

[jschlyter]

Good catch!

Do we need to add special test cases given that RFC 4034 §3.1.5 states "As a direct consequence, the values contained in these fields cannot refer to dates more than 68 years in either the past or the future." ?

[TochusC]

Thanks for the comment. I added tests for both inception and expiration at the 68-year boundary and one second inside it.