From 060b0d2f703b24086157697b075185d6176713ea Mon Sep 17 00:00:00 2001
From: dongshengyuan <545258830@qq.com>
Date: Wed, 12 Aug 2026 13:36:36 +0800
Subject: [PATCH] resolvectl: reject tlsa without a domain

The tlsa command accepts an optional service family before the domain list.
When the only argument was "tcp", "udp", or "sctp", we consumed it as the
family and returned success without issuing any query.

Reproducer:

  build/resolvectl tlsa tcp

Before: the command printed nothing and exited with status 0.

Follow-up for: ebbc70e511c8b18f299f58dd641805eaab603865
---
 src/resolve/resolvectl.c       | 3 +++
 test/units/TEST-75-RESOLVED.sh | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/src/resolve/resolvectl.c b/src/resolve/resolvectl.c
index 9af5626059..5e51664763 100644
--- a/src/resolve/resolvectl.c
+++ b/src/resolve/resolvectl.c
@@ -1161,6 +1161,9 @@ static int verb_tlsa(int argc, char *argv[], uintptr_t _data, void *userdata) {
         } else
                 args = strv_skip(argv, 1);
 
+        if (strv_isempty(args))
+                return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "The tlsa command requires at least one domain.");
+
         STRV_FOREACH(p, args)
                 RET_GATHER(ret, resolve_tlsa(family, *p));
 
diff --git a/test/units/TEST-75-RESOLVED.sh b/test/units/TEST-75-RESOLVED.sh
index 85e9e4cc84..d3a7d38259 100755
--- a/test/units/TEST-75-RESOLVED.sh
+++ b/test/units/TEST-75-RESOLVED.sh
@@ -627,6 +627,8 @@ testcase_08_resolved() {
     grep -qF '"data":"' "$RUN_OUT"
     (! run resolvectl openpgp mr.smith@signed.test --json=short --type=A)
     grep -qF -- "The openpgp command may only be combined with --type=OPENPGPKEY." "$RUN_OUT"
+    (! run resolvectl tlsa tcp)
+    grep -qF -- "The tlsa command requires at least one domain." "$RUN_OUT"
     (! run resolvectl tlsa signed.test:invalid --json=short)
     grep -qF 'Invalid port "invalid".' "$RUN_OUT"
     (! run resolvectl tlsa signed.test --json=short --type=A)