Bug 14037 - knot-resolver fails to start when TLS hostnames are not specified for dns servers but TLS is configured as dns protocol
Summary: knot-resolver fails to start when TLS hostnames are not specified for dns ser...
Status: NEW
Alias: None
Product: IPFire
Classification: Unclassified
Component: --- (show other bugs)
Version: 2
Hardware: unspecified Unspecified
: - Unknown - Major Usability
Assignee: Assigned to nobody - feel free to grab it and work on it
QA Contact:
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-08-08 09:07 UTC by teissler
Modified: 2026-08-08 09:08 UTC (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description teissler 2026-08-08 09:07:56 UTC 
Today i upgraded one of my ipfire and had no working dns after update.

When starting knot-resolver it dies after several seconds.

The following logs appeared in /var/log/messages:

Aug  8 09:08:17 fw01 kresd[5034]: [system] error while loading config: error occurred here (config filename:lineno is at the bottom, if config is involved): stack traceback:        [C]: in function 'tls_client'   /usr/lib/knot-resolver/kres_modules/policy.lua:176: in function 'TLS_FORWARD'   /usr/lib/knot-resolver/kres_modules/policy.lua:890: in function 'forward_convert_targets'       /usr/lib/knot-resolver/kres_modules/policy.lua:922: in function 'rule_forward_add'      /usr/lib/knot-resolver/config.lua:243: in function 'load_forwarders'    policy-loader.conf:60: in main chunk ERROR: invalid hostname (workdir '/run/knot-resolver')

After switching the dns protocol from TLS to UDP knot-resolver starts succesfully and everything works again.

Problem was that the configured dns servers had no TLS hostname specified.
So problem occurred because i specified DNS servers without TLS hostnames and switch dns protocol afterwards, which probably should verify that TLS hostnames are specified.