[GH-ISSUE #2383] hickory fails to parse distro packaged dnssec trust anchor #974

New issue

Closed

opened 2026-03-16 01:08:49 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 01:08:49 +03:00

Owner

Originally created by @japaric on GitHub (Aug 26, 2024).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2383

Originally assigned to: @japaric on GitHub.

Describe the bug
what the title says

To Reproduce
configure hickory-dns as a validating resolver and use Arch Linux's dnssec-anchors as the static key

Expected behavior
hickory-dns should start up correctly but instead it fails with this error message

1724668835:INFO:hickory_server::store::recursor::authority:46:loading recursor config: .
Error: could not load zone .: invalid time string: IN

unbound is able to handle this trusted key file

System:

OS: Ubuntu Linux
Architecture: x86_64
Version 22.04
rustc version: 1.80.1

Version:
Crate: hickory-dns
Version: b1697b901f

Additional context
The problem appears to be that the trusted key file in dnssec-anchors omits the TTL field.

In our tests, the trusted key file looks like this

.	86400	IN	DNSKEY	257 3 8 <space separated base64 encoded data>

dnssec-archors' static key looks like this

. IN DNSKEY 257 3 8 <base64 encoded data without whitespace>

we'll need to update the trusted key parser to handle this

Originally created by @japaric on GitHub (Aug 26, 2024). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2383 Originally assigned to: @japaric on GitHub. **Describe the bug** what the title says **To Reproduce** configure `hickory-dns` as a validating resolver and use Arch Linux's [`dnssec-anchors`](https://archlinux.org/packages/core/any/dnssec-anchors/) as the static key **Expected behavior** `hickory-dns` should start up correctly but instead it fails with this error message ``` console 1724668835:INFO:hickory_server::store::recursor::authority:46:loading recursor config: . Error: could not load zone .: invalid time string: IN ``` `unbound` is able to handle this trusted key file **System:** - OS: Ubuntu Linux - Architecture: x86_64 - Version 22.04 - rustc version: 1.80.1 **Version:** Crate: `hickory-dns` Version: b1697b901fb61fdc6e4f0c83ac2171404adf8b67 **Additional context** The problem appears to be that the trusted key file in `dnssec-anchors` omits the TTL field. In our tests, the trusted key file looks like this ``` text . 86400 IN DNSKEY 257 3 8 <space separated base64 encoded data> ``` `dnssec-archors`' static key looks like this ``` text . IN DNSKEY 257 3 8 <base64 encoded data without whitespace> ``` we'll need to update the trusted key parser to handle this