TA bootstrap doesn't work without external resolver

If /etc/resolv.conf contains nameserver 127.0.0.1 and the nameserver running on 127.0.0.1 is the Knot Resolver instance bootstrapping the root TA, then the bootstrapping fails with name resolution error as it doesn't start resolving until the root TA is bootstrapped.

Knot Resolver should be able to resolve at least data.iana.org when doing the bootstrap and it should probably fail to start if it can't bootstrap root TA.

I see no easy fixup ATM. I thought of resolving data.iana.org separately and then using the IP instead of it, but that won't work, even with plain http, getting to 404. The lua modules we use currently don't seem to support SNI.

Resolver uses lua-http for another module (http2) and that one is documented to support SNI, so that might be a way.

Our current function should support it now, but not in any released version of luasec yet: https://github.com/brunoos/luasec/issues/44#issuecomment-285943779

added bug minor labels

Currently released version of luasec probably now supports what we need to make this work "easily".

@ljezek Can you please test what happens after your changes in !894 (merged)?

assigned to @ljezek

I will answer to myself: !894 (merged) did not change this.

Given current state of packages in Linux distros I wonder if we still need the bootstrap, or if we need to have it so tightly integrated. Maybe it should be an explicit call like trust_anchors.bootstrap() or something?

@vcunat @tkrizek Do you have an opinion on user interface? Should trust_anchors.add_file() magically create file if it does not exist?

mentioned in issue #536 (closed)

I'd be happy to throw away ta_bootstrap. If it was ever needed, those times are long gone.

We distribute (and install by default) up-to-date root.keys as a part of our release tarball and all our distribution packages use either this file or a keyfile from their distro package.

Perhaps. This TA bootstrapping doesn't seem important to me. Of course, if you're e.g. setting up a secure router that's been "disconnected" for many months, you'll get into problems... but I expect even there you want to primarily approach this on (package) updater layer which will also ensure up-to-date root.keys.

trust_anchors.add_file('file' [, false]) with non-existing (or empty?) file is kind-of an edge case. It only makes sense to trigger root TA bootstrapping there, and in that case creating the file seems sensible to me. I suppose it could be typo-prone, but I'm not convinced it's worth guarding against that.