From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4h5kVT2Fqvz3667 for ; Thu, 23 Jul 2026 21:17:53 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4h5kVP4R1Tz2xHh for ; Thu, 23 Jul 2026 21:17:49 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4h5kVN624Gz3hS; Thu, 23 Jul 2026 21:17:48 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1784841468; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=EZqzTAzFgTpCmYuFASBzFMfCQKTB2OdPvUEPFjBhJv0=; b=Fo+8YeG/vHzKmWM0qfEKknvPD+uL8mvGIsP3F+xbxU22WhrHxLAZ8eAY9hjcFBv5DzXs/Y e5cZz6KUuoRNYwCw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1784841468; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=EZqzTAzFgTpCmYuFASBzFMfCQKTB2OdPvUEPFjBhJv0=; b=pDjlvvGWbGJc1anru52t6F+pMeih74hbj3OHxq7iTKsVlQL9bHNZsGt5aKfFt01Cyhvmct W8KvUwr6ZvTW+OzChU73ajJJNC5h3oTKFqThZPE/Wjb2Fm4eef+CHK9qErxQHbkpDUla6W 6yMavJm+wpTnRqYu/xDhvpxwWhx5yoH+bYcjD7QGDYHYX9Xp50Va757BH9F1uqV+6GN9Lx vY3A9OYyhv9K0qlqP/VwpHH3649/7t1TmHU8JgrpGek4PuMq7JcWsQ5XxMiqqRjx+oLxvg AFlo+HG489IzejX4wgsagXlsJmp+NOoDubkBqVOS3WulRkP1aBiCRRJ+t8PaVw== Content-Type: multipart/mixed; boundary="------------szG6Niktv04TSB6L7dJhp31M" Message-ID: <14b83a61-7167-4a10-aef5-7c909171f4aa@ipfire.org> Date: Thu, 23 Jul 2026 23:17:40 +0200 Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 From: Matthias Fischer Subject: Re: Core 203 - DNS firewall doesn't update (?) or add (!) - zone files To: "IPFire: Tremer, Michael" Cc: "IPFire: Development-List" References: <6662cba6-6773-4040-ace7-7be7f8ad3679@ipfire.org> Content-Language: en-US In-Reply-To: This is a multi-part message in MIME format. --------------szG6Niktv04TSB6L7dJhp31M Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit (2nd try - this didn't show up on the public inbox, so I removed the attachments) ########## On 23.07.2026 11:05, Michael Tremer wrote: > Hello Matthias, Hi Michael, sorry, this is a bit longer. ;-) > What happens when you run "update-rpzs”? Cursor went one line down...waited...and showed normal bash prompt again. No errors. But something weird happened before - I had some problems, found a solution, but don't know what the solution was... ;-) Steps to reproduce (perhaps?): - I built an update for 'knot-resolver v6.4.1' under Core 203 - this was built without any problem, I only had to deactivate the existing patch file. Hm. - I stripped the files by hand and built an archive with the command:tar cvfz ../uploads/knot-resolver-6.4.1-for-ipfire-Core203.tar.gz -C build_x86_64 --files-from=config/rootfiles/common/knot-resolver I'm doing this procedure all the time with all updated programs so I can install and test them on my testmachine or my productive machine, whatever comes first. - In the next step I copied this resolver-archive to the root directory of my productive machine (sigh!), stopped the running 'knot-resolver' (at least I think this stops him) with '/etc/init.d/knot-resolver stop' and extracted the archive with the command: tar xvf knot-resolver-6.4.1-for-ipfire-Core203.tar.gz -C / E.g., I did this the same way before I pushed the last 'knot 3.5.6'-update. No problem. Until the update for 'knot-resolver 6.4.1'. Result: - Restarting the 'knot-resolver 6.4.1' failed, DNS was completely broken. And the 'Domain Name Sstem'-Log was filled with 'kresd' and 'knot_resolver.manager.server:' errors ("kresd[20064]: [system] error while loading config: error occurred here" or "Uncaught generic exception during manager inicialization"). Hm! Since I had backups of all essential files of the previous version (6.4.0), I copied them back - with the same result. DNS stayed broken, no matter what I did. Old version, new version, nothing started, always the same crashes. I checked rights, I checked contents, rebooted, no chance. I don't know if I missed something - nothing worked. Then today I copied a fresh built 'core-upgrade-2.29-203.ipfire' to '/opt/pakfire/tmp' and updated the whole system just like I did a few days ago through pakfire, only this time from console per './update.sh' and rebooted. Suddenly DNS was running - and I could add the "Gambling" list (e.g.) to DNS-Firewall - it was downloaded and seems to work. So now DNS is working (again) but I don't know why it was broken and I don't know what fixed it in the end... weird. EDIT: If it helps I could open a bug report, explain the process and attach an excerpt of the dns log. ;-) I don't like to push this update until I know what happened... ;-) Best Matthias > -Michael > >> On 22 Jul 2026, at 14:02, Matthias Fischer wrote: >> >> Hi, >> >> I have one problem with Core 203 and I'm not sure whats the culprit: >> >> No matter what I do, Core 203 won't download additional zone files. >> >> After rebooting I found the already used and activated blocklists (from >> Core 202) in the '/var/lib//knot-resolver/zones' dirextory. They're >> working - no seen problem. But even if I activate them all on the DNSBL >> page, nothing gets downloaded, the selection and number of block lists >> always remain the same. It won't add or remove any of the existing lists. >> >> Can anyone confirm? OR give me a hint where to look at? >> >> Thanks in advance >> Matthias >> >> > > --------------szG6Niktv04TSB6L7dJhp31M Content-Type: text/x-moz-deleted; charset=UTF-8; name="Deleted: excerpt-from DNS log.txt" Content-Disposition: attachment; filename="Deleted: excerpt-from DNS log.txt" Content-Transfer-Encoding: base64 WW91IGRlbGV0ZWQgYW4gYXR0YWNobWVudCBmcm9tIHRoaXMgbWVzc2FnZS4gVGhlIG9yaWdp bmFsIE1JTUUgaGVhZGVycyBmb3IgdGhlIGF0dGFjaG1lbnQgd2VyZToNCkNvbnRlbnQtVHlw ZTogdGV4dC9wbGFpbjsgY2hhcnNldD1VVEYtODsgbmFtZT0iZXhjZXJwdC1mcm9tIEROUyBs b2cudHh0Ig0KQ29udGVudC1EaXNwb3NpdGlvbjogYXR0YWNobWVudDsgZmlsZW5hbWU9ImV4 Y2VycHQtZnJvbSBETlMgbG9nLnR4dCINCkNvbnRlbnQtVHJhbnNmZXItRW5jb2Rpbmc6IGJh c2U2NA0KDQoNCg== --------------szG6Niktv04TSB6L7dJhp31M Content-Type: text/x-moz-deleted; charset=UTF-8; name="Deleted: knot-resolver-6.4.1-for-ipfire-Core203.tar.gz" Content-Disposition: attachment; filename="Deleted: knot-resolver-6.4.1-for-ipfire-Core203.tar.gz" Content-Transfer-Encoding: base64 WW91IGRlbGV0ZWQgYW4gYXR0YWNobWVudCBmcm9tIHRoaXMgbWVzc2FnZS4gVGhlIG9yaWdp bmFsIE1JTUUgaGVhZGVycyBmb3IgdGhlIGF0dGFjaG1lbnQgd2VyZToNCkNvbnRlbnQtVHlw ZTogYXBwbGljYXRpb24vZ3ppcDsNCiBuYW1lPSJrbm90LXJlc29sdmVyLTYuNC4xLWZvci1p cGZpcmUtQ29yZTIwMy50YXIuZ3oiDQpDb250ZW50LURpc3Bvc2l0aW9uOiBhdHRhY2htZW50 Ow0KIGZpbGVuYW1lPSJrbm90LXJlc29sdmVyLTYuNC4xLWZvci1pcGZpcmUtQ29yZTIwMy50 YXIuZ3oiDQpDb250ZW50LVRyYW5zZmVyLUVuY29kaW5nOiBiYXNlNjQNCg0KDQo= --------------szG6Niktv04TSB6L7dJhp31M--