knot-resolver will fail to start if hostname option is not specified when using DoT

[fuomag9]

knot-resolver will fail to start if hostname option is not specified when using DoT

Feb 22 09:55:03 knot knot_resolver.manager.manager[4445]: Failed to load policy rules: failed to start 'policy-loader'
Feb 22 09:55:03 knot knot_resolver.manager.server[4445]: Uncaught generic exception during manager inicialization...
                                                         Traceback (most recent call last):
                                                           File "/usr/lib/python3/dist-packages/knot_resolver/manager/server.py", line 590, in start_server
                                                             manager = await _init_manager(config_store)
                                                                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                                                           File "/usr/lib/python3/dist-packages/knot_resolver/manager/server.py", line 450, in _init_manager
                                                             manager = await KresManager.create(controller, config_store)
                                                                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                                                           File "/usr/lib/python3/dist-packages/knot_resolver/manager/manager.py", line 109, in create
                                                             await inst._async_init(subprocess_controller, config_store)  # noqa: SLF001
                                                             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                                                           File "/usr/lib/python3/dist-packages/knot_resolver/manager/manager.py", line 124, in _async_init
                                                             await config_store.register_verifier(self.load_policy_rules)
                                                           File "/usr/lib/python3/dist-packages/knot_resolver/manager/config_store.py", line 48, in register_verifier
                                                             raise DataParsingError(f"Initial config verification failed with error: {res.unwrap_err()}")
                                                         knot_resolver.utils.modeling.exceptions.DataParsingError: Initial config verification failed with error: kresd 'policy-loader' process failed to start. Config might be invalid.

works

forward:
  # encrypted public resolver, again for all names
  - subtree: .
    servers:
      - address: [ 2001:148f:fffe::1, 193.17.47.1 ]
        transport: tls
        hostname: odvr.nic.cz

doesn't work

forward:
  # encrypted public resolver, again for all names
  - subtree: .
    servers:
      - address: [ 2001:148f:fffe::1, 193.17.47.1 ]
        transport: tls

kresctl 6.0.10 will validate both configurations, but the second one will fail.

knot-resolver -V
6.0.10

[vcunat]

Anyone can MITM you, as you don't have a way to validate who's on the other side. Somehow this case isn't well covered by the 6.x config model, and you can only see kresd complaining in the log

ERROR: no way to authenticate and not set as insecure

I think we'll want the config to explicitly say insecure: true or something, so that people seeing the config will realize that while it is TLS, the properties aren't what you normally expect of TLS.

[fuomag9]

Anyone can MITM you, as you don't have a way to validate who's on the other side. Somehow this case isn't well covered by the 6.x config model, and you can only see kresd complaining in the log

ERROR: no way to authenticate and not set as insecure

I think we'll want the config to explicitly say insecure: true or something, so that people seeing the config will realize that while it is TLS, the properties aren't what you normally expect of TLS.

Thanks for the reply, is there any way to specify multiple hostnames in the same server or do I have to insert multiple "." Zones if I want to use multiple DoT DNS servers?

[vcunat]

Neither. Example:

forward:
  - subtree: .
    servers:
      - address: [ 2001:148f:fffe::1, 193.17.47.1 ]
        transport: tls
        hostname: odvr.nic.cz
      - address: [ 9.9.9.9 ]
        transport: tls
        hostname: dns.quad9.net

[fuomag9]

Neither. Example:

forward:
  - subtree: .
    servers:
      - address: [ 2001:148f:fffe::1, 193.17.47.1 ]
        transport: tls
        hostname: odvr.nic.cz
      - address: [ 9.9.9.9 ]
        transport: tls
        hostname: dns.quad9.net

Thank you very much!