{"record":{"id":"a7a867b1573242f4","repo":"AdguardTeam/AdGuardHome","slug":"bad-dns-protocol-q","errorCode":null,"errorMessage":"bad dns protocol %q","messagePattern":"bad dns protocol %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"internal/home/mobileconfig.go","lineNumber":137,"sourceCode":"\tcase dnsProtoHTTPS:\n\t\tdspName = fmt.Sprintf(\"%s DoH\", d.ServerName)\n\t\tu := &url.URL{\n\t\t\tScheme: urlutil.SchemeHTTPS,\n\t\t\tHost:   d.ServerName,\n\t\t\tPath:   path.Join(\"/dns-query\", clientID),\n\t\t}\n\t\td.ServerURL = u.String()\n\n\t\t// Empty the ServerName field since it is only must be presented\n\t\t// in DNS-over-TLS configuration.\n\t\td.ServerName = \"\"\n\tcase dnsProtoTLS:\n\t\tdspName = fmt.Sprintf(\"%s DoT\", d.ServerName)\n\t\tif clientID != \"\" {\n\t\t\td.ServerName = clientID + \".\" + d.ServerName\n\t\t}\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"bad dns protocol %q\", proto)\n\t}\n\n\tpayloadID := fmt.Sprintf(\"%s.%s\", dnsSettingsPayloadType, uuid.New())\n\tdata := &mobileConfig{\n\t\tPayloadDescription: \"Adds AdGuard Home to macOS Big Sur and iOS 14 or newer systems\",\n\t\tPayloadDisplayName: dspName,\n\t\tPayloadType:        \"Configuration\",\n\t\tPayloadScope:       \"System\",\n\t\tPayloadContent: []*payloadContent{{\n\t\t\tDNSSettings:     d,\n\t\t\tOnDemandEnabled: 1,\n\t\t\tOnDemandRules: []*onDemandRule{{\n\t\t\t\tAction: \"Connect\",\n\t\t\t}},\n\t\t\tPayloadType:        dnsSettingsPayloadType,\n\t\t\tPayloadIdentifier:  payloadID,\n\t\t\tPayloadDisplayName: dspName,\n\t\t\tPayloadDescription: \"Configures device to use AdGuard Home\",","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/AdguardTeam/AdGuardHome/blob/b41aefbe51c8dde65e2c50f093996afa0502edf9/internal/home/mobileconfig.go#L119-L155","documentation":"encodeMobileConfig was asked to generate an Apple mobile configuration profile for a DNS protocol that isn't DNS-over-TLS or DNS-over-HTTPS. The switch on proto fell through to the default case.","triggerScenarios":"GET /apple/mobileconfig.proto (handleMobileConfig) with a .proto extension other than .dot (e.g. .txt, .doh with malformed upstream config, or empty protocol) so proto doesn't match dnsProtoTLS or dnsProtoHTTPS.","commonSituations":"Users typing the mobile-config URL manually with a wrong extension, or upstream DNS settings that leave the DoH server name empty causing earlier validation to misroute; also plain-DNS-only installs trying to fetch a profile.","solutions":["Use the correct URL suffix: /apple/mobileconfig.doh.png or /apple/mobileconfig.dot.png","Configure at least one DNS-over-HTTPS or DNS-over-TLS upstream server before requesting a profile"],"exampleFix":"# before\nGET /apple/mobileconfig.txt\n\n# after\nGET /apple/mobileconfig.doh.png","handlingStrategy":"validation","validationCode":"var validProto = map[string]bool{\"dns-over-tls\": true, \"dns-over-https\": true}\nif !validProto[proto] { http.Error(w, \"use .doh or .dot\", http.StatusBadRequest); return }","typeGuard":"func isMobileConfigProto(p string) bool { return p == dnsProtoTLS || p == dnsProtoHTTPS }","tryCatchPattern":null,"preventionTips":["Always use the documented /apple/mobileconfig.doh.png or .dot.png URLs","Ensure a DoH/DoT upstream is configured before offering profiles to users"],"tags":["go","apple","mobileconfig","dns-protocol","http-api"],"backgroundTag":"unsupported-protocol-value","analyzedSha":"b41aefbe51c8dde65e2c50f093996afa0502edf9","analyzedAt":"2026-08-27T04:57:55.097Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}