Bug 14037

Summary:	knot-resolver fails to start when TLS hostnames are not specified for dns servers but TLS is configured as dns protocol
Product:	IPFire	Reporter:	teissler <timo.eissler>
Component:	---	Assignee:	Assigned to nobody - feel free to grab it and work on it <nobody>
Status:	NEW ---	QA Contact:
Severity:	Major Usability
Priority:	- Unknown -	CC:	timo.eissler
Version:	2
Hardware:	unspecified
OS:	Unspecified

Description teissler 2026-08-08 09:07:56 UTC

Today i upgraded one of my ipfire and had no working dns after update.

When starting knot-resolver it dies after several seconds.

The following logs appeared in /var/log/messages:

Aug  8 09:08:17 fw01 kresd[5034]: [system] error while loading config: error occurred here (config filename:lineno is at the bottom, if config is involved): stack traceback:        [C]: in function 'tls_client'   /usr/lib/knot-resolver/kres_modules/policy.lua:176: in function 'TLS_FORWARD'   /usr/lib/knot-resolver/kres_modules/policy.lua:890: in function 'forward_convert_targets'       /usr/lib/knot-resolver/kres_modules/policy.lua:922: in function 'rule_forward_add'      /usr/lib/knot-resolver/config.lua:243: in function 'load_forwarders'    policy-loader.conf:60: in main chunk ERROR: invalid hostname (workdir '/run/knot-resolver')

After switching the dns protocol from TLS to UDP knot-resolver starts succesfully and everything works again.

Problem was that the configured dns servers had no TLS hostname specified.
So problem occurred because i specified DNS servers without TLS hostnames and switch dns protocol afterwards, which probably should verify that TLS hostnames are specified.