10 Dub
2026
10 Dub
'26
12:00
Hello,
I'm using this config.yaml with Knot Resolver 6 (on Debian 13):
workers: auto
network:
listen:
- interface: 127.0.0.1@53
logging:
level: info
options:
violators-workarounds: true
cache:
size-max: 100M
prefetch:
expiring: true
dnssec:
log-bogus: true
local-data:
rpz:
- file: /var/lib/rpz/urlhaus.abuse.ch.rpz
- file: /var/lib/rpz/threatfox.abuse.ch.rpz
lua:
script: |
policy.add(policy.suffix(policy.DENY, {todname('use-application-dns.net.')}))
policy.add(policy.suffix(policy.PASS, policy.todnames({
'uribl.com',
'zen.spamhaus.org',
'dbl.spamhaus.org',
'list.dnswl.org',
'sa-trusted.bondedsender.org',
'sa-accredit.habeas.com',
'bl.score.senderscore.com',
'dnsbl-1.uceprotect.net',
'dnsbl-2.uceprotect.net',
'dnsbl-3.uceprotect.net'
})))
policy.add(policy.all(policy.TLS_FORWARD({
{'9.9.9.9', hostname='dns.quad9.net',
ca_file='/etc/ssl/certs/ca-certificates.crt' },
{'149.112.112.112', hostname='dns.quad9.net',
ca_file='/etc/ssl/certs/ca-certificates.crt' },
})))
This results in this endless loop in the logs:
Apr 10 11:56:49 supervisord[56300]: captured stdio output from policy-loader[56777]
(stderr): [system] config 'policy-loader.conf' (workdir
'/run/knot-resolver'): No such file or directory
Apr 10 11:56:49 supervisord[56300]: success: policy-loader entered RUNNING state, process
has stayed up for > than 0 seconds (startsecs)
Apr 10 11:56:49 supervisord[56300]: exited: policy-loader (exit status 1; not expected)
Apr 10 11:56:49 supervisord[56300]: spawned: 'policy-loader' with pid 56778
Apr 10 11:56:49 supervisord[56300]: captured stdio output from policy-loader[56778]
(stderr): [system] config 'policy-loader.conf' (workdir
'/run/knot-resolver'): No such file or directory
Apr 10 11:56:49 supervisord[56300]: success: policy-loader entered RUNNING state, process
has stayed up for > than 0 seconds (startsecs)
Apr 10 11:56:50 supervisord[56300]: exited: policy-loader (exit status 1; not expected)
When using only one rpz file, thus removing the whole line
- file: /var/lib/rpz/threatfox.abuse.ch.rpz
it works fine.
What am I doing wrong here?
--
Frederik Himpe <frederik(a)frehi.be>
10 Dub
10 Dub
12:49
Hello.
The policies fail to load, so a retry loop happens.
On 10/04/2026 12.00, Frederik Himpe via knot-resolver-users wrote:
Apr 10 11:56:49 supervisord[56300]: captured stdio
output from policy-loader[56778] (stderr): [system] config 'policy-loader.conf'
(workdir '/run/knot-resolver'): No such file or directory
Well, this log line is really weird and we don't know why it happens for
you. But I tried to download the threatfox RPZ and it won't parse
anyway because of this line apparently having an illegally
formatted/escaped domain name:
egqfg1ah2lbhoksjmxz30w== CNAME . ; Botnet C2 - confidence level: 75% (2025_12_14),
seehttps://threatfox.abuse.ch/ioc/1679082/
policy-loader[2385553]: [rules ] error parsing zone file `/tmp/threatfox.abuse.ch.rpz`,
error -989: invalid domain name character
--Vladimir
22:25
Apr 10
11:56:49 supervisord[56300]: captured stdio output from
policy-loader[56778] (stderr): [system] config 'policy-loader.conf'
(workdir '/run/knot-resolver'): No such file or directory
Well, this log line is really weird and we don't know why it happens
for you. But I tried to download the threatfox RPZ and it won't
parse anyway because of this line apparently having an illegally
formatted/escaped domain name:
11 Dub
11 Dub
8:37
On 10/04/2026 22.25, Frederik Himpe wrote:
I found out it happens when the file system
/run/knot-resolver is full.
OK, we could try improving diagnostics for such common situations.
It seems like /run/knotresolver/ruledb/data.mdb
becomes very large. I
have about 60 MB of RPZ files, of which the largest one is this:
https://github.com/hagezi/dns-blocklists/blob/main/rpz/tif.txt
Yet, 256 MB of tmpfs is not enough for /run/knot-resolver and then it
will end up in a loop.
When loading that RPZ afresh, it takes 85 MiB. (du -hs
/run/knotresolver/ruledb/data.mdb)
That's if you delete that file before loading. But for smooth reload we
use transactions, and as we don't know what's changed in a file and
other settings, we load everything anew. Compounded with non-ideal
management of free space in LMDB, I see about 3x this initial size used
when using a system continuously. E.g. a quick experiment, reloading
with just this RPZ a few times, the du-size converges to 254 MiB.
I certainly do plan to look into making this more RAM-efficient at some
point in future. Not that contrary to resolver before 6.0, this space is
shared by all workers, not multiplied by their number.
--Vladimir
51
days inactive
52
days old
knot-resolver-users@lists.nic.cz
3 comments
2 participants
participants (2)
-
Frederik Himpe -
Vladimír Čunát