[PATCH 0/2] Fix DNS-over-TLS after changing DNS settings (#14781)

[PATCH 0/2] Fix DNS-over-TLS after changing DNS settings (#14781)

[Antonio Quartulli]

Enabling DNS-over-TLS in dns.cgi breaks DNS until knot-resolver is
restarted: a reload doesn't restart the kresd workers, which only set up
TLS forwarders at startup.

Also, changes to the server list weren't applied at all.

Patch 1 adds a force-reload (rolling restart of the workers), patch 2
uses it in dns.cgi. The other reload callers are unchanged.
With a single worker, each save causes a sub-second DNS gap.

Files to ship: /srv/web/ipfire/cgi-bin/dns.cgi,
/etc/rc.d/init.d/knot-resolver, /usr/local/bin/dnsctrl

Antonio Quartulli (2):
  knot-resolver: Add force-reload
  dns.cgi: Force a reload after every change

 html/cgi-bin/dns.cgi                 | 7 ++++---
 src/initscripts/system/knot-resolver | 9 ++++++++-
 src/misc-progs/dnsctrl.c             | 7 +++++++
 3 files changed, 19 insertions(+), 4 deletions(-)

-- 
2.56.0

[PATCH 1/2] knot-resolver: Add force-reload

[Antonio Quartulli]

A reload doesn't restart the workers when config.yaml is unchanged, so
they keep what their Lua script set up at startup. force-reload (also
available through dnsctrl) replaces them with a rolling restart.

Signed-off-by: Antonio Quartulli <antonio@mandelbit.com>
---
 src/initscripts/system/knot-resolver | 9 ++++++++-
 src/misc-progs/dnsctrl.c             | 7 +++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/src/initscripts/system/knot-resolver b/src/initscripts/system/knot-resolver
index 980a095f3..a27323b37 100644
--- a/src/initscripts/system/knot-resolver
+++ b/src/initscripts/system/knot-resolver
@@ -45,6 +45,13 @@ case "${1}" in
 			--config=/etc/knot-resolver/config.yaml reload
 		;;
 
+	force-reload)
+		# Replace the workers too, so that they re-run the Lua script
+		# (e.g. to register the DNS-over-TLS forwarders)
+		/usr/bin/kresctl \
+			--config=/etc/knot-resolver/config.yaml reload --force
+		;;
+
 	restart)
 		${0} stop
 		sleep 1
@@ -56,7 +63,7 @@ case "${1}" in
 		;;
 
 	*)
-		echo "Usage: ${0} {start|stop|reload|restart|status}"
+		echo "Usage: ${0} {start|stop|reload|force-reload|restart|status}"
 		exit 1
 		;;
 esac
diff --git a/src/misc-progs/dnsctrl.c b/src/misc-progs/dnsctrl.c
index 84b0ae211..66007c8f7 100644
--- a/src/misc-progs/dnsctrl.c
+++ b/src/misc-progs/dnsctrl.c
@@ -28,6 +28,13 @@ int main(int argc, char** argv) {
 
 		return run("/etc/rc.d/init.d/knot-resolver", args);
 
+	} else if (strcmp(argv[1], "force-reload") == 0) {
+		char* args[] = {
+			"force-reload", NULL,
+		};
+
+		return run("/etc/rc.d/init.d/knot-resolver", args);
+
 	} else if (strcmp(argv[1], "sync-rpzs") == 0) {
 		char* args[] = {
 			NULL,
-- 
2.56.0

[PATCH 2/2] dns.cgi: Force a reload after every change

[Antonio Quartulli]

The workers only set up DNS-over-TLS forwarders at startup, so after
enabling TLS they sent plain DNS to port 853 until knot-resolver was
restarted. Changes to the server list didn't reload at all.

Fixes: #14781
Signed-off-by: Antonio Quartulli <antonio@mandelbit.com>
---
 html/cgi-bin/dns.cgi | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/html/cgi-bin/dns.cgi b/html/cgi-bin/dns.cgi
index 713b0a308..d0080f7b6 100644
--- a/html/cgi-bin/dns.cgi
+++ b/html/cgi-bin/dns.cgi
@@ -105,9 +105,6 @@ if ($cgiparams{'GENERAL'} eq _('Save')) {
 		# Call function to handle unbound restart, etc.
 		&_handle_unbound_and_more()
 	}
-
-	# Reload DNS
-	&General::system_background("/usr/local/bin/dnsctrl", "reload");
 }
 
 ###
@@ -823,6 +820,10 @@ END
 
 # Private function to handle the restart of unbound and more.
 sub _handle_unbound_and_more () {
+	# Reload DNS and restart the workers, as they only read the
+	# forwarders when they start
+	&General::system_background("/usr/local/bin/dnsctrl", "force-reload");
+
 	# Check if the IDS is running.
 	if(&IDS::ids_is_running()) {
 		# Re-generate the file which contains the DNS Server
-- 
2.56.0