starred/hickory-dns

Fork 0

mirror of https://github.com/hickory-dns/hickory-dns.git synced 2026-04-25 11:15:54 +03:00

[GH-ISSUE #2000] `dns` of `util` got a not same behaviour with `named` on querying from quic server #842

New issue

Closed

opened 2026-03-16 00:31:41 +03:00 by kerem · 8 comments

kerem commented

2026-03-16 00:31:41 +03:00

Owner

Originally created by @hingbong on GitHub (Aug 16, 2023).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2000

What is the question?
When I am using dns command, I got

.\target\release\dns.exe -p quic -n [2a10:50c0::ad2:ff]:853 -t dns.adguard.com --debug query dns.google A
; using quic:[2a10:50c0::ad2:ff]:853 dns_name:dns.adguard.com
; sending query: dns.google IN A
2023-08-16T11:21:34.118803Z DEBUG trust_dns_proto::xfer::dns_handle: querying: dns.google A
2023-08-16T11:21:34.119046Z DEBUG trust_dns_proto::xfer: enqueueing message:QUERY:[Query { name: Name("dns.google"), query_type: A, query_class: IN }]
2023-08-16T11:21:34.119502Z DEBUG trust_dns_proto::quic::quic_stream: received packet len: 39 bytes: b"\0\0\x01\0\0\x01\0\0\0\0\0\x01\x03dns\x06google\0\0\x01\0\x01\0\0)\x04\xd0\0\0\0\0\0\0"
2023-08-16T11:21:34.196541Z DEBUG trust_dns_proto::quic::quic_stream: received packet len: 71 bytes: b"\0\0\x81\x80\0\x01\0\x02\0\0\0\x01\x03dns\x06google\0\0\x01\0\x01\xc0\x0c\0\x01\0\x01\0\0\0\xf1\0\x04\x08\x08\x08\x08\xc0\x0c\0\x01\0\x01\0\0\0\xf1\0\x04\x08\x08\x04\x04\0\0)\0\0\0\0\0\0\0\0"
; received response
; header 0:RESPONSE:RD,RA:NoError:QUERY:2/0/1
; edns version: 0 dnssec_ok: false max_payload: 512 opts: 0
; query
;; dns.google. IN A
; answers 2
dns.google. 241 IN A 8.8.8.8
dns.google. 241 IN A 8.8.4.4
; nameservers 0
; additionals 1

2023-08-16T11:21:34.198127Z DEBUG trust_dns_proto::xfer::dns_exchange: io_stream is done, shutting down

and I set up named with config ./target/release/trust-dns -c forwarder.toml -z ./tests/test-data/test_configs/ -p 24141

log_level = "debug"
listen_addrs_ipv4 = [ "0.0.0.0" ]

[[zones]]
zone = "."

zone_type = "Forward"
stores = { type = "forward", name_servers = [{ socket_addr = "[2a10:50c0:0:0:0:0:ad2:ff]:853", protocol = "quic", tls_dns_name = "dns.adguard.com"}] }

I got

1692185284:INFO:trust_dns:336:Trust-DNS 0.23.0-alpha.5 starting
1692185284:INFO:trust_dns:341:loading configuration from: ".\\tests\\test-data\\test_configs\\example_forwarder.toml"
1692185284:DEBUG:trust_dns:147:loading zone with config: ZoneConfig {
    zone: ".",
    zone_type: Forward,
    file: None,
    allow_update: None,
    allow_axfr: None,
    enable_dnssec: None,
    keys: [],
    stores: Some(
        Forward(
            ForwardConfig {
                name_servers: NameServerConfigGroup(
                    [
                        NameServerConfig {
                            socket_addr: [2a10:50c0::ad2:ff]:853,
                            protocol: Quic,
                            tls_dns_name: Some(
                                "dns.adguard.com",
                            ),
                            trust_negative_responses: false,
                            tls_config: None,
                            bind_addr: None,
                        },
                    ],
                    None,
                ),
                options: None,
            },
        ),
    ),
}
1692185284:INFO:trust_dns_server::store::forwarder::authority:54:loading forwarder config: .
1692185284:INFO:trust_dns_server::store::forwarder::authority:82:forward resolver configured: .:
1692185284:INFO:trust_dns:268:zone successfully loaded: .
1692185284:INFO:trust_dns:401:binding UDP to 0.0.0.0:24141
1692185284:INFO:trust_dns:406:listening for UDP on 0.0.0.0:24141
1692185284:DEBUG:trust_dns_server::server::server_future:63:registering udp: PollEvented { io: Some(UdpSocket { addr: 0.0.0.0:24141, socket: 332 }) }
1692185284:INFO:trust_dns:419:binding TCP to 0.0.0.0:24141
1692185284:INFO:trust_dns:424:listening for TCP on 0.0.0.0:24141
1692185284:DEBUG:trust_dns_server::server::server_future:138:register tcp: PollEvented { io: Some(TcpListener { addr: 0.0.0.0:24141, socket: 340 }) }
1692185284:INFO:trust_dns:689:
1692185284:INFO:trust_dns:690:    o                      o            o
1692185284:INFO:trust_dns:691:    |                      |            |
1692185284:INFO:trust_dns:692:  --O--  o-o  o  o  o-o  --O--  o-o   o-O  o-o   o-o
1692185284:INFO:trust_dns:693:    |    |    |  |   \     |         |  |  |  |   \
1692185284:INFO:trust_dns:694:    o    o    o--o  o-o    o          o-o  o  o  o-o
1692185284:INFO:trust_dns:695:
1692185284:INFO:trust_dns:479:awaiting connections...
1692185284:INFO:trust_dns:484:Server starting up
1692185287:DEBUG:trust_dns_server::server::server_future:87:received udp request from: 172.28.8.212:55191
1692185287:DEBUG:trust_dns_server::server::server_future:934:request:55483 src:UDP://172.28.8.212#55191 type:QUERY dnssec:false QUERY:dns.google.:A:IN qflags:RD,AD
1692185287:DEBUG:trust_dns_server::authority::catalog:139:query received: 55483
1692185287:DEBUG:trust_dns_server::authority::catalog:385:searching authorities for: dns.google.
1692185287:DEBUG:trust_dns_server::authority::catalog:385:searching authorities for: google.
1692185287:DEBUG:trust_dns_server::authority::catalog:385:searching authorities for: .
1692185287:DEBUG:trust_dns_server::authority::catalog:408:request: 55483 found authority: .
1692185287:DEBUG:trust_dns_server::authority::catalog:456:no DAU in request, used default SupportAlgorithms
1692185287:DEBUG:trust_dns_server::authority::catalog:488:performing name: dns.google. type: A class: IN on .
1692185287:DEBUG:trust_dns_server::authority::authority_object:190:performing name: dns.google. type: A class: IN on .
1692185287:DEBUG:trust_dns_server::store::forwarder::authority:129:forwarding lookup: dns.google. A
1692185287:DEBUG:trust_dns_proto::xfer::dns_handle:67:querying: dns.google. A
1692185287:DEBUG:trust_dns_resolver::name_server::name_server_pool:258:sending request: [Query { name: Name("dns.google."), query_type: A, query_class: IN, mdns_unicast_response: false }]
1692185287:DEBUG:trust_dns_resolver::name_server::name_server:105:reconnecting: NameServerConfig { socket_addr: [2a10:50c0::ad2:ff]:853, protocol: Quic, tls_dns_name: Some("dns.adguard.com"), trust_negative_responses: false, tls_config: None, bind_addr: None }
1692185287:DEBUG:trust_dns_proto::xfer::dns_exchange:330:stream errored while connecting error=error with quic connection: aborted by peer: the cryptographic handshake failed: error 120
1692185287:DEBUG:trust_dns_resolver::name_server::name_server_pool:258:sending request: [Query { name: Name("dns.google."), query_type: A, query_class: IN, mdns_unicast_response: false }]
1692185287:DEBUG:trust_dns_resolver::name_server::name_server:105:reconnecting: NameServerConfig { socket_addr: [2a10:50c0::ad2:ff]:853, protocol: Quic, tls_dns_name: Some("dns.adguard.com"), trust_negative_responses: false, tls_config: None, bind_addr: None }
1692185287:DEBUG:trust_dns_proto::xfer::dns_exchange:330:stream errored while connecting error=error with quic connection: aborted by peer: the cryptographic handshake failed: error 120
1692185287:DEBUG:trust_dns_resolver::name_server::name_server_pool:258:sending request: [Query { name: Name("dns.google."), query_type: A, query_class: IN, mdns_unicast_response: false }]
1692185287:DEBUG:trust_dns_resolver::name_server::name_server:105:reconnecting: NameServerConfig { socket_addr: [2a10:50c0::ad2:ff]:853, protocol: Quic, tls_dns_name: Some("dns.adguard.com"), trust_negative_responses: false, tls_config: None, bind_addr: None }
1692185287:DEBUG:trust_dns_proto::xfer::dns_exchange:330:stream errored while connecting error=error with quic connection: aborted by peer: the cryptographic handshake failed: error 120
1692185287:DEBUG:trust_dns_server::authority::catalog:642:error resolving: Forward resolution error: proto error: error with quic connection: aborted by peer: the cryptographic handshake failed: error 120
1692185287:DEBUG:trust_dns_server::server::response_handler:106:response: 55483 response_code: No Error
1692185287:INFO:trust_dns_server::server::server_future:882:request:55483 src:UDP://172.28.8.212#55191 QUERY:dns.google.:A:IN qflags:RD,AD response:NoError rr:0/0/1 rflags:RD,RA

How to modify the config to make it work?
Thanks

Originally created by @hingbong on GitHub (Aug 16, 2023). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2000 What is the question? When I am using `dns` command, I got ``` .\target\release\dns.exe -p quic -n [2a10:50c0::ad2:ff]:853 -t dns.adguard.com --debug query dns.google A ; using quic:[2a10:50c0::ad2:ff]:853 dns_name:dns.adguard.com ; sending query: dns.google IN A 2023-08-16T11:21:34.118803Z DEBUG trust_dns_proto::xfer::dns_handle: querying: dns.google A 2023-08-16T11:21:34.119046Z DEBUG trust_dns_proto::xfer: enqueueing message:QUERY:[Query { name: Name("dns.google"), query_type: A, query_class: IN }] 2023-08-16T11:21:34.119502Z DEBUG trust_dns_proto::quic::quic_stream: received packet len: 39 bytes: b"\0\0\x01\0\0\x01\0\0\0\0\0\x01\x03dns\x06google\0\0\x01\0\x01\0\0)\x04\xd0\0\0\0\0\0\0" 2023-08-16T11:21:34.196541Z DEBUG trust_dns_proto::quic::quic_stream: received packet len: 71 bytes: b"\0\0\x81\x80\0\x01\0\x02\0\0\0\x01\x03dns\x06google\0\0\x01\0\x01\xc0\x0c\0\x01\0\x01\0\0\0\xf1\0\x04\x08\x08\x08\x08\xc0\x0c\0\x01\0\x01\0\0\0\xf1\0\x04\x08\x08\x04\x04\0\0)\0\0\0\0\0\0\0\0" ; received response ; header 0:RESPONSE:RD,RA:NoError:QUERY:2/0/1 ; edns version: 0 dnssec_ok: false max_payload: 512 opts: 0 ; query ;; dns.google. IN A ; answers 2 dns.google. 241 IN A 8.8.8.8 dns.google. 241 IN A 8.8.4.4 ; nameservers 0 ; additionals 1 2023-08-16T11:21:34.198127Z DEBUG trust_dns_proto::xfer::dns_exchange: io_stream is done, shutting down ``` and I set up named with config `./target/release/trust-dns -c forwarder.toml -z ./tests/test-data/test_configs/ -p 24141` ``` log_level = "debug" listen_addrs_ipv4 = [ "0.0.0.0" ] [[zones]] zone = "." zone_type = "Forward" stores = { type = "forward", name_servers = [{ socket_addr = "[2a10:50c0:0:0:0:0:ad2:ff]:853", protocol = "quic", tls_dns_name = "dns.adguard.com"}] } ``` I got ``` 1692185284:INFO:trust_dns:336:Trust-DNS 0.23.0-alpha.5 starting 1692185284:INFO:trust_dns:341:loading configuration from: ".\\tests\\test-data\\test_configs\\example_forwarder.toml" 1692185284:DEBUG:trust_dns:147:loading zone with config: ZoneConfig { zone: ".", zone_type: Forward, file: None, allow_update: None, allow_axfr: None, enable_dnssec: None, keys: [], stores: Some( Forward( ForwardConfig { name_servers: NameServerConfigGroup( [ NameServerConfig { socket_addr: [2a10:50c0::ad2:ff]:853, protocol: Quic, tls_dns_name: Some( "dns.adguard.com", ), trust_negative_responses: false, tls_config: None, bind_addr: None, }, ], None, ), options: None, }, ), ), } 1692185284:INFO:trust_dns_server::store::forwarder::authority:54:loading forwarder config: . 1692185284:INFO:trust_dns_server::store::forwarder::authority:82:forward resolver configured: .: 1692185284:INFO:trust_dns:268:zone successfully loaded: . 1692185284:INFO:trust_dns:401:binding UDP to 0.0.0.0:24141 1692185284:INFO:trust_dns:406:listening for UDP on 0.0.0.0:24141 1692185284:DEBUG:trust_dns_server::server::server_future:63:registering udp: PollEvented { io: Some(UdpSocket { addr: 0.0.0.0:24141, socket: 332 }) } 1692185284:INFO:trust_dns:419:binding TCP to 0.0.0.0:24141 1692185284:INFO:trust_dns:424:listening for TCP on 0.0.0.0:24141 1692185284:DEBUG:trust_dns_server::server::server_future:138:register tcp: PollEvented { io: Some(TcpListener { addr: 0.0.0.0:24141, socket: 340 }) } 1692185284:INFO:trust_dns:689: 1692185284:INFO:trust_dns:690: o o o 1692185284:INFO:trust_dns:691: | | | 1692185284:INFO:trust_dns:692: --O-- o-o o o o-o --O-- o-o o-O o-o o-o 1692185284:INFO:trust_dns:693: | | | | \ | | | | | \ 1692185284:INFO:trust_dns:694: o o o--o o-o o o-o o o o-o 1692185284:INFO:trust_dns:695: 1692185284:INFO:trust_dns:479:awaiting connections... 1692185284:INFO:trust_dns:484:Server starting up 1692185287:DEBUG:trust_dns_server::server::server_future:87:received udp request from: 172.28.8.212:55191 1692185287:DEBUG:trust_dns_server::server::server_future:934:request:55483 src:UDP://172.28.8.212#55191 type:QUERY dnssec:false QUERY:dns.google.:A:IN qflags:RD,AD 1692185287:DEBUG:trust_dns_server::authority::catalog:139:query received: 55483 1692185287:DEBUG:trust_dns_server::authority::catalog:385:searching authorities for: dns.google. 1692185287:DEBUG:trust_dns_server::authority::catalog:385:searching authorities for: google. 1692185287:DEBUG:trust_dns_server::authority::catalog:385:searching authorities for: . 1692185287:DEBUG:trust_dns_server::authority::catalog:408:request: 55483 found authority: . 1692185287:DEBUG:trust_dns_server::authority::catalog:456:no DAU in request, used default SupportAlgorithms 1692185287:DEBUG:trust_dns_server::authority::catalog:488:performing name: dns.google. type: A class: IN on . 1692185287:DEBUG:trust_dns_server::authority::authority_object:190:performing name: dns.google. type: A class: IN on . 1692185287:DEBUG:trust_dns_server::store::forwarder::authority:129:forwarding lookup: dns.google. A 1692185287:DEBUG:trust_dns_proto::xfer::dns_handle:67:querying: dns.google. A 1692185287:DEBUG:trust_dns_resolver::name_server::name_server_pool:258:sending request: [Query { name: Name("dns.google."), query_type: A, query_class: IN, mdns_unicast_response: false }] 1692185287:DEBUG:trust_dns_resolver::name_server::name_server:105:reconnecting: NameServerConfig { socket_addr: [2a10:50c0::ad2:ff]:853, protocol: Quic, tls_dns_name: Some("dns.adguard.com"), trust_negative_responses: false, tls_config: None, bind_addr: None } 1692185287:DEBUG:trust_dns_proto::xfer::dns_exchange:330:stream errored while connecting error=error with quic connection: aborted by peer: the cryptographic handshake failed: error 120 1692185287:DEBUG:trust_dns_resolver::name_server::name_server_pool:258:sending request: [Query { name: Name("dns.google."), query_type: A, query_class: IN, mdns_unicast_response: false }] 1692185287:DEBUG:trust_dns_resolver::name_server::name_server:105:reconnecting: NameServerConfig { socket_addr: [2a10:50c0::ad2:ff]:853, protocol: Quic, tls_dns_name: Some("dns.adguard.com"), trust_negative_responses: false, tls_config: None, bind_addr: None } 1692185287:DEBUG:trust_dns_proto::xfer::dns_exchange:330:stream errored while connecting error=error with quic connection: aborted by peer: the cryptographic handshake failed: error 120 1692185287:DEBUG:trust_dns_resolver::name_server::name_server_pool:258:sending request: [Query { name: Name("dns.google."), query_type: A, query_class: IN, mdns_unicast_response: false }] 1692185287:DEBUG:trust_dns_resolver::name_server::name_server:105:reconnecting: NameServerConfig { socket_addr: [2a10:50c0::ad2:ff]:853, protocol: Quic, tls_dns_name: Some("dns.adguard.com"), trust_negative_responses: false, tls_config: None, bind_addr: None } 1692185287:DEBUG:trust_dns_proto::xfer::dns_exchange:330:stream errored while connecting error=error with quic connection: aborted by peer: the cryptographic handshake failed: error 120 1692185287:DEBUG:trust_dns_server::authority::catalog:642:error resolving: Forward resolution error: proto error: error with quic connection: aborted by peer: the cryptographic handshake failed: error 120 1692185287:DEBUG:trust_dns_server::server::response_handler:106:response: 55483 response_code: No Error 1692185287:INFO:trust_dns_server::server::server_future:882:request:55483 src:UDP://172.28.8.212#55191 QUERY:dns.google.:A:IN qflags:RD,AD response:NoError rr:0/0/1 rflags:RD,RA ``` How to modify the config to make it work? Thanks

kerem closed this issue

2026-03-16 00:31:46 +03:00

kerem commented

2026-03-16 00:31:51 +03:00

Author

Owner

@bluejekyll commented on GitHub (Aug 22, 2023):

Can you share the configuration you used when compiling? I'm not sure why you're having an issue. There is also the resolve command, which is closer to the subsystem used by the Forwarder in trust-dns. Do you think you could see if that command produces different behavior? resolve is closer to nslookup whereas dns is closer to dig.

@bluejekyll commented on GitHub (Aug 22, 2023): Can you share the configuration you used when compiling? I'm not sure why you're having an issue. There is also the `resolve` command, which is closer to the subsystem used by the Forwarder in trust-dns. Do you think you could see if that command produces different behavior? `resolve` is closer to `nslookup` whereas `dns` is closer to `dig`.

kerem commented

2026-03-16 00:31:57 +03:00

Author

Owner

@hingbong commented on GitHub (Aug 22, 2023):

I built it just using cargo build --release -p trust-dns -F dns-over-https-rustls -F dns-over-quic -F resolver -F recursor to build, will it use different cert, such as ones from system and the others from somewhere?

@hingbong commented on GitHub (Aug 22, 2023): I built it just using `cargo build --release -p trust-dns -F dns-over-https-rustls -F dns-over-quic -F resolver -F recursor` to build, will it use different cert, such as ones from system and the others from somewhere?

kerem commented

2026-03-16 00:32:02 +03:00

Author

Owner

@hingbong commented on GitHub (Aug 22, 2023):

And I am on Windows.

@hingbong commented on GitHub (Aug 22, 2023): And I am on Windows.

kerem commented

2026-03-16 00:32:07 +03:00

Author

Owner

@bluejekyll commented on GitHub (Sep 6, 2023):

I wonder if this is related to here: #2015

@bluejekyll commented on GitHub (Sep 6, 2023): I wonder if this is related to here: #2015

kerem commented

2026-03-16 00:32:12 +03:00

Author

Owner

@hingbong commented on GitHub (Oct 9, 2023):

I've updated to commit 45bd92f4ac07ef7d9fa1830a6b596239d01302da, and get this with same config, it looks like related to #2038

1696862737:DEBUG:trust_dns_server::server::server_future:90:received udp request from: 172.17.157.195:58687
1696862737:DEBUG:trust_dns_server::server::server_future:1021:request:21168 src:UDP://172.17.157.195#58687 type:QUERY dnssec:false QUERY:dns.google.:A:IN qflags:RD,AD
1696862737:DEBUG:trust_dns_server::authority::catalog:139:query received: 21168
1696862737:DEBUG:trust_dns_server::authority::catalog:385:searching authorities for: dns.google.
1696862737:DEBUG:trust_dns_server::authority::catalog:385:searching authorities for: google.
1696862737:DEBUG:trust_dns_server::authority::catalog:385:searching authorities for: .
1696862737:DEBUG:trust_dns_server::authority::catalog:408:request: 21168 found authority: .
1696862737:DEBUG:trust_dns_server::authority::catalog:456:no DAU in request, used default SupportAlgorithms
1696862737:DEBUG:trust_dns_server::authority::catalog:488:performing name: dns.google. type: A class: IN on .
1696862737:DEBUG:trust_dns_server::authority::authority_object:190:performing name: dns.google. type: A class: IN on .
1696862737:DEBUG:trust_dns_server::store::forwarder::authority:129:forwarding lookup: dns.google. A
1696862737:DEBUG:trust_dns_proto::xfer::dns_handle:67:querying: dns.google. A
1696862737:DEBUG:trust_dns_resolver::name_server::name_server_pool:258:sending request: [Query { name: Name("dns.google."), query_type: A, query_class: IN }]
1696862737:DEBUG:trust_dns_resolver::name_server::name_server:105:reconnecting: NameServerConfig { socket_addr: [2a10:50c0::ad2:ff]:853, protocol: Quic, tls_dns_name: Some("dns.adguard.com"), trust_negative_responses: true, tls_config: None, bind_addr: None }
1696862737:DEBUG:trust_dns_proto::xfer::dns_exchange:341:stream errored while connecting error=error with quic connection: the cryptographic handshake failed: error 48: invalid peer certificate: UnknownIssuer
1696862737:DEBUG:trust_dns_resolver::name_server::name_server_pool:258:sending request: [Query { name: Name("dns.google."), query_type: A, query_class: IN }]
1696862737:DEBUG:trust_dns_resolver::name_server::name_server:105:reconnecting: NameServerConfig { socket_addr: [2a10:50c0::ad2:ff]:853, protocol: Quic, tls_dns_name: Some("dns.adguard.com"), trust_negative_responses: true, tls_config: None, bind_addr: None }
1696862737:DEBUG:trust_dns_proto::xfer::dns_exchange:341:stream errored while connecting error=error with quic connection: the cryptographic handshake failed: error 48: invalid peer certificate: UnknownIssuer
1696862737:DEBUG:trust_dns_resolver::name_server::name_server_pool:258:sending request: [Query { name: Name("dns.google."), query_type: A, query_class: IN }]
1696862737:DEBUG:trust_dns_resolver::name_server::name_server:105:reconnecting: NameServerConfig { socket_addr: [2a10:50c0::ad2:ff]:853, protocol: Quic, tls_dns_name: Some("dns.adguard.com"), trust_negative_responses: true, tls_config: None, bind_addr: None }
1696862739:DEBUG:trust_dns_proto::xfer::dns_exchange:341:stream errored while connecting error=error with quic connection: the cryptographic handshake failed: error 48: invalid peer certificate: UnknownIssuer
1696862739:DEBUG:trust_dns_server::authority::catalog:642:error resolving: Forward resolution error: proto error: error with quic connection: the cryptographic handshake failed: error 48: invalid peer certificate: UnknownIssuer
1696862739:DEBUG:trust_dns_server::server::response_handler:106:response: 21168 response_code: No Error
1696862739:INFO:trust_dns_server::server::server_future:969:request:21168 src:UDP://172.17.157.195#58687 QUERY:dns.google.:A:IN qflags:RD,AD response:NoError rr:0/0/1 rflags:RD,RA

@hingbong commented on GitHub (Oct 9, 2023): I've updated to commit `45bd92f4ac07ef7d9fa1830a6b596239d01302da`, and get this with same config, it looks like related to #2038 ``` 1696862737:DEBUG:trust_dns_server::server::server_future:90:received udp request from: 172.17.157.195:58687 1696862737:DEBUG:trust_dns_server::server::server_future:1021:request:21168 src:UDP://172.17.157.195#58687 type:QUERY dnssec:false QUERY:dns.google.:A:IN qflags:RD,AD 1696862737:DEBUG:trust_dns_server::authority::catalog:139:query received: 21168 1696862737:DEBUG:trust_dns_server::authority::catalog:385:searching authorities for: dns.google. 1696862737:DEBUG:trust_dns_server::authority::catalog:385:searching authorities for: google. 1696862737:DEBUG:trust_dns_server::authority::catalog:385:searching authorities for: . 1696862737:DEBUG:trust_dns_server::authority::catalog:408:request: 21168 found authority: . 1696862737:DEBUG:trust_dns_server::authority::catalog:456:no DAU in request, used default SupportAlgorithms 1696862737:DEBUG:trust_dns_server::authority::catalog:488:performing name: dns.google. type: A class: IN on . 1696862737:DEBUG:trust_dns_server::authority::authority_object:190:performing name: dns.google. type: A class: IN on . 1696862737:DEBUG:trust_dns_server::store::forwarder::authority:129:forwarding lookup: dns.google. A 1696862737:DEBUG:trust_dns_proto::xfer::dns_handle:67:querying: dns.google. A 1696862737:DEBUG:trust_dns_resolver::name_server::name_server_pool:258:sending request: [Query { name: Name("dns.google."), query_type: A, query_class: IN }] 1696862737:DEBUG:trust_dns_resolver::name_server::name_server:105:reconnecting: NameServerConfig { socket_addr: [2a10:50c0::ad2:ff]:853, protocol: Quic, tls_dns_name: Some("dns.adguard.com"), trust_negative_responses: true, tls_config: None, bind_addr: None } 1696862737:DEBUG:trust_dns_proto::xfer::dns_exchange:341:stream errored while connecting error=error with quic connection: the cryptographic handshake failed: error 48: invalid peer certificate: UnknownIssuer 1696862737:DEBUG:trust_dns_resolver::name_server::name_server_pool:258:sending request: [Query { name: Name("dns.google."), query_type: A, query_class: IN }] 1696862737:DEBUG:trust_dns_resolver::name_server::name_server:105:reconnecting: NameServerConfig { socket_addr: [2a10:50c0::ad2:ff]:853, protocol: Quic, tls_dns_name: Some("dns.adguard.com"), trust_negative_responses: true, tls_config: None, bind_addr: None } 1696862737:DEBUG:trust_dns_proto::xfer::dns_exchange:341:stream errored while connecting error=error with quic connection: the cryptographic handshake failed: error 48: invalid peer certificate: UnknownIssuer 1696862737:DEBUG:trust_dns_resolver::name_server::name_server_pool:258:sending request: [Query { name: Name("dns.google."), query_type: A, query_class: IN }] 1696862737:DEBUG:trust_dns_resolver::name_server::name_server:105:reconnecting: NameServerConfig { socket_addr: [2a10:50c0::ad2:ff]:853, protocol: Quic, tls_dns_name: Some("dns.adguard.com"), trust_negative_responses: true, tls_config: None, bind_addr: None } 1696862739:DEBUG:trust_dns_proto::xfer::dns_exchange:341:stream errored while connecting error=error with quic connection: the cryptographic handshake failed: error 48: invalid peer certificate: UnknownIssuer 1696862739:DEBUG:trust_dns_server::authority::catalog:642:error resolving: Forward resolution error: proto error: error with quic connection: the cryptographic handshake failed: error 48: invalid peer certificate: UnknownIssuer 1696862739:DEBUG:trust_dns_server::server::response_handler:106:response: 21168 response_code: No Error 1696862739:INFO:trust_dns_server::server::server_future:969:request:21168 src:UDP://172.17.157.195#58687 QUERY:dns.google.:A:IN qflags:RD,AD response:NoError rr:0/0/1 rflags:RD,RA ```

kerem commented

2026-03-16 00:32:17 +03:00

Author

Owner

@djc commented on GitHub (Oct 10, 2023):

cc @daxpedda

@djc commented on GitHub (Oct 10, 2023): cc @daxpedda

kerem commented

2026-03-16 00:32:22 +03:00

Author

Owner

@hingbong commented on GitHub (Oct 10, 2023):

I compiled it for OpenWRT and it got a same result, so it's not a Windows-only issue.

@hingbong commented on GitHub (Oct 10, 2023): I compiled it for OpenWRT and it got a same result, so it's not a Windows-only issue.

kerem commented

2026-03-16 00:32:27 +03:00

Author

Owner

@daxpedda commented on GitHub (Oct 11, 2023):

I'm not entirely familiar with the CLI, but as far as I can see:

1696862739:DEBUG:trust_dns_server::authority::catalog:642:error resolving: Forward resolution error: proto error: error > with quic connection: the cryptographic handshake failed: error 48: invalid peer certificate: UnknownIssuer

root certificates seem to be missing.

I built it just using cargo build --release -p trust-dns -F dns-over-https-rustls -F dns-over-quic -F resolver -F recursor to build, will it use different cert, such as ones from system and the others from somewhere?

Doesn't include a crate feature that pulls in certificates. On the other hand, I just realized, we messed up in #2005 because the trust-dns CLI doesn't seem to include any root certificates or crate features to enable them. I will make a PR soonish.

@daxpedda commented on GitHub (Oct 11, 2023): I'm not entirely familiar with the CLI, but as far as I can see: > ``` > 1696862739:DEBUG:trust_dns_server::authority::catalog:642:error resolving: Forward resolution error: proto error: error > with quic connection: the cryptographic handshake failed: error 48: invalid peer certificate: UnknownIssuer > ``` root certificates seem to be missing. > I built it just using `cargo build --release -p trust-dns -F dns-over-https-rustls -F dns-over-quic -F resolver -F recursor` to build, will it use different cert, such as ones from system and the others from somewhere? Doesn't include a crate feature that pulls in certificates. On the other hand, I just realized, we messed up in #2005 because the `trust-dns` CLI doesn't seem to include any root certificates or crate features to enable them. I will make a PR soonish.

kerem referenced this issue

2026-03-16 02:22:29 +03:00

[PR #842] [MERGED] Aug 1 2019 updates #1735