[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 9a45c759d6367516bfb0c9a5516a50fc7920c5e5

[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 9a45c759d6367516bfb0c9a5516a50fc7920c5e5

[Michael Tremer]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  9a45c759d6367516bfb0c9a5516a50fc7920c5e5 (commit)
      from  240827441761c4eb7640d0cf98e857659cb66cfb (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 9a45c759d6367516bfb0c9a5516a50fc7920c5e5
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Tue May 26 17:18:55 2026 +0100

    knot resolver: Explicitely use TCP/TLS for outbound queries
    
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 config/knot-resolver/config.lua  | 15 +++++++++++++++
 config/knot-resolver/config.yaml |  3 +++
 2 files changed, 18 insertions(+)

Difference in files:
diff --git a/config/knot-resolver/config.lua b/config/knot-resolver/config.lua
index bb8546ec4..2e741e864 100644
--- a/config/knot-resolver/config.lua
+++ b/config/knot-resolver/config.lua
@@ -136,6 +136,21 @@ local function reverse_zones(address, netmask)
 	return zones
 end
 
+-- Configure transport
+function config.transport()
+	-- Load the settings
+	local settings = config.load_settings("/var/ipfire/dns/settings")
+
+	-- Force using TCP (and/or TLS) if configured
+	if settings["PROTO"] == "TCP" or settings["PROTO"] == "TLS" then
+		policy.add(
+			policy.all(
+				policy.FLAGS("TCP")
+			)
+		)
+	end
+end
+
 -- Setup DNS Forwarders
 function config.load_forwarders(settings)
 	-- Fetch the transport protocol
diff --git a/config/knot-resolver/config.yaml b/config/knot-resolver/config.yaml
index 4114939f1..9fc6d069b 100644
--- a/config/knot-resolver/config.yaml
+++ b/config/knot-resolver/config.yaml
@@ -42,6 +42,9 @@ lua:
     -- Load config helpers
     local config = require("config")
 
+    -- Configure transport
+    config.transport()
+
     -- Load DHCP Leases Lookup
     config.load_leases()
 


hooks/post-receive
--
IPFire 2.x development tree